Improper link resolution before file access in the Windows Update stack allows an authorized local user to elevate privileges. The flaw arises from following symbolic links without proper checks, enabling a local attacker to gain higher access rights on the system. The primary impact is local privilege escalation, classified under CWE-284, and can lead to unauthorized changes or execution with elevated privileges.

Microsoft Windows 11 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2025 (including Server Core). These operating systems, for both x64 and arm64 architectures where applicable, are affected by the vulnerability.

The CVSS score of 7.8 indicates a high severity level, but the EPSS score is not available, and the vulnerability is listed in the CISA KEV catalog. This status indicates that the vulnerability is actively exploited or exploited in the wild, raising the risk level. Exploitation requires local authorized user privileges; there is no publicly available remote vector. Consequently, the risk remains significant for users with administrative access, while general public exposure is limited.