The vulnerability in Windows Setup Files Cleanup arises from external control of system or configuration setting, permitting an authorized local attacker to elevate privileges. The flaw is a misconfiguration weakness (CWE-15). An attacker who has local access can manipulate cleanup settings to gain higher privileges, potentially enabling further exploits or data compromise. The impact is local privilege escalation, which can affect the entire system integrity.

The affected products include multiple versions of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 23H2, 26H1), and Windows Server releases spanning 2012 to 2025. The versions span both server core and traditional installations, with support across x86, x64, arm64 architectures. All instances that use the Windows Setup Files Cleanup component without the patch are vulnerable.

The CVSS score of 7.8 classifies this issue as high severity, and the EPSS score is not available, suggesting limited publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attack requires an authorized user with local access, meaning the threat surface is primarily internal. Nonetheless, a compromised local account could abuse the upgraded privileges, so the risk remains significant.