This vulnerability involves improper access control within the Windows Geotag Broker, allowing an authorized attacker to gain elevated privileges on the local system. The flaw is a classic access control weakness (CWE‑862) that can be abused to execute higher‑privileged code or modify system settings, potentially leading to full local compromise. Exploitation can enable the attacker to install malware, bypass security controls, or gain persistent access.

Microsoft includes a broad range of Windows releases in the advisory, from Windows 10 version 1607 through Windows 11 version 26 H2 and multiple Windows Server editions (2016, 2019, 2022, 2025). All highlighted versions are affected, whether in x86, x64, or ARM64 architectures, as noted in the vendor’s advisory. The Geotag Broker component is present across these platforms, so any user of these OS releases is potentially impacted.

The CVSS base score of 7.8 classifies the issue as high severity. While EPSS information is missing, the absence of KEV listing does not negate the risk. The flaw requires an attacker with local or privileged user status to trigger the elevation, implying that it is not remotely exploitable. Once local access is obtained, however, the impact is significant and swift, making timely patching essential.