The vulnerability stems from an improper null termination in the Windows Program Compatibility Assistant Service, allowing an attacker who already has local access to elevate privileges. This flaw is classified as CWE-170, which can lead to a complete compromise of the affected system by granting the attacker higher rights than intended.

The affected products include Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 (both ARM64 and x64 builds) as well as Microsoft Windows Server 2022 and Windows Server 2025, including the Server Core installation. These installations are vulnerable where the Program Compatibility Assistant Service runs.

With a CVSS base score of 7.8, the vulnerability falls into the high severity range. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of this analysis. Based on the description, the likely attack vector is local – an attacker who can reliably execute code on the target machine can manipulate the service to bypass null termination checks and gain elevated privileges.