The vulnerability is a time‑of‑check time‑of‑use race condition in the Windows Setup Files Cleanup mechanism, identified as CWE‑367. An attacker who already has local user privileges can trigger the cleanup process to run at a time when a security check has already succeeded but a subsequent use of the cleaned file or resource does not re‑verify permissions, allowing the attacker to gain elevated rights on the machine. As a result, local privileged escalation can occur, potentially allowing full administrative control.

Affected Windows releases include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both standard and Server Core editions. The issue was reported for multiple architectures, including x86, x64 and arm64.

The CVSS score is 7.0, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so immediate exploitation pressure may be moderate. However, the requirement for local authorisation means that any privileged user who can tamper with the cleanup routine could exploit this flaw. Because it is a race condition, an attacker would need to trigger the cleanup while the system has performed a permission check but before re‑checking, a scenario that can be engineered locally. The lack of a public advisory with a fixed update suggests that the official fix will arrive via the Windows Update or Security Update Guide, and until then the risk remains until the update is applied.