An untrusted search path flaw in Windows Setup Files Cleanup allows an authorized local user to execute code with elevated privileges. The missing validation of which directory is searched for cleanup binaries lets an attacker place a malicious executable in a directory that the system will preferentially load, resulting in privilege escalation. This issue is classified as CWE‑426 and can lead to arbitrary code execution at system level, jeopardizing confidentiality, integrity, and availability.

The flaw affects a broad range of Windows operating systems, including Windows 10 releases 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions from 2012 through 2025, including both full and server core installations.

With a CVSS base score of 7.0 the vulnerability is considered high impact. EPSS data are unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at present. The likely attack vector is a local authenticated user performing setup cleanup operations, exploiting the insecure search path to launch privileged code. Successful exploitation would grant the attacker full control of the affected machine.