This vulnerability arises from improper control of code generation within the Windows Encrypting File System (EFS), which permits an attacker with authorized access to inject and execute arbitrary code. The flaw is classified as a code‑injection weakness (CWE‑94) and enables the attacker to run malicious code over the network, potentially compromising confidentiality, integrity, and availability of the affected system.

The affected products include multiple Windows operating systems: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 23H2 (Arm64), as well as 26H1; and Windows Server 2016, 2019, 2022, and 2025, touching both Server Core and full editions across x86, x64, and ARM64 architectures.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based; an attacker who is already authorized to use EFS features can exploit this flaw to execute code on the target system, potentially escalating privileges or gaining full control.