The vulnerability is an untrusted search‑path flaw within Windows Servicing Stack Updates that permits a locally authenticated attacker to run code with elevated privileges. By inserting malicious binaries into a directory that is searched before trusted system directories, an attacker can execute arbitrary code as the system account. This can lead to full compromise of the affected computer, enabling the attacker to read, modify, or delete any file, install back‑doors, or disrupt system availability. The weakness is classified as CWE‑426, which indicates a trusted path that is optionally overridable by untrusted inputs.

Affected products are various Windows operating systems. The flaw exists in Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H2, including the 26H1 update; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025. Both client and server installations are impacted, across both x86 and x64 platforms, as well as ARM64 for certain Windows 11 releases.

The CVSS score of 7.8 places this flaw in the high severity range. The EPSS score is not available, but the lack of a CISA KEV listing suggests that there has not yet been a public exploitation. Nonetheless, the attack vector is local with an authorized user and the exploitation path is straightforward: place a malicious executable in an untrusted path that is searched before the system path, then trigger a Servicing Stack Update. Because the vulnerability requires existing local administrator or equivalent rights, the risk is predominantly to systems where privileged users are common. For environments that enforce least‑privilege and restrict local admin rights, the practical risk is lower. Regardless, the high CVSS rating warrants prompt remediation.