The vulnerability occurs when the Windows Search component performs an unsafe resolution of links before accessing files. This flaw, a CWE‑59 path‑traversal problem, lets a user who already has local access create or manipulate a link that points to an arbitrary file. When the search process follows the link, it reads or writes the target file with the search component’s privileges, effectively granting the attacker elevated rights and the ability to modify or read sensitive data.

The flaw affects a wide range of Microsoft Windows releases. All versions of Windows 10 from 1607 through 22H2 and the corresponding Server Core editions are vulnerable, as are Windows 11 releases from 23H2 to 26H2 (including 26H1) and their Server Core variants. In addition, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 are impacted. This includes both x86 and x64 builds, as well as ARM64 editions of Windows 11.

The CVSS score of 7.8 reflects a high severity but the EPSS score is not currently available, leaving the exact likelihood of exploitation uncertain. The flaw is not listed in CISA’s KEV catalog and is exploitable only by users with local authorization; no remote attack vector is disclosed. Because the privilege escalation gives the attacker the same rights as the Windows Search service, an attacker could potentially bypass local user limits, gain administrative access, and compromise the entire system if the environment allows. Administrators should treat this as a high‑priority remediation item.