Improper link resolution before file access, commonly called "link following", in the Windows User Profile Service allows a user with local access to bypass normal permission checks and gain elevated privileges. The weakness is a path traversal flaw (CWE‑59) that causes the service to follow shortcut or symbolic link references without validating the target against the user's access rights. An attacker using a malicious link placed in a privileged directory can execute code with the user's account or, by linking to system files, promote to a higher privilege level, risking unauthorized access to confidential data, system integrity, or availability.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core editions. Affected operating systems are available on x86, x64 and ARM64 platforms depending on the specific release. The vulnerability is present in the User Profile Service component across all these entries.

The CVSS base score of 7.8 signifies a high likelihood of success under the correct conditions. The EPSS is currently not published, so the exploitation probability cannot be quantified, but the flaw requires an attacker to have a legitimate user session or local foothold. Because the vulnerability is not listed in the CISA KEV catalog, there is no indication of active exploitation in the wild, yet the local nature of the attack vector means that any authenticated user could abuse it. The risk is elevated for systems with weak local account controls or commonly using shortcut files that could redirect execution paths.