An improper authorization check in Windows Virtual Input allows an attacker who already has local access to elevate privileges. The flaw provides a path to elevate an account to higher privilege levels, potentially gaining full Administrator rights. This vulnerability falls under the Unauthorized Access (CWE‑283) weakness, where the system fails to enforce proper access controls on the Virtual Input component.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2019, Server 2019 (Server Core), and Windows Server 2022. The affected builds span x86, x64, and arm64 architectures, covering both desktop and server operating systems.

The vulnerability is rated with a CVSS score of 7.8, indicating a significant security impact. The EPSS score is not available, so the precise likelihood of exploitation is uncertain; however, it is considered a moderate to high risk for systems that allow local attackers. The CVE is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation to date. Attackers would need local access to the machine and would exploit the lack of proper authorization in the Virtual Input subsystem to gain elevated privileges.