This vulnerability is an improper authorization flaw (CWE‑863) in the Windows Device Install Service that permits a local user who is authenticated to the system to perform privileged operations. A successful exploitation results in the attacker gaining administrative rights on the affected host, thereby compromising confidentiality, integrity, and availability of all resources on that machine. The flaw arises because the service fails to validate that the requester has the necessary privileges before allowing privileged actions to proceed.

The flaw impacts Microsoft Windows 10 versions 21H2 and 22H2, all Windows 11 builds from 23H2 through 26H2 (including the 26H1 edition), as well as Windows Server 2022 and Windows Server 2025, including the Server Core installation option. This covers x86, x64, arm64, and arm64‑based systems as enumerated in the CPE list.

The CVSS score of 7.8 indicates a high severity level. EPSS data is not available, and the vulnerability is not featured in the CISA KEV catalog, suggesting it may not yet be widely exploited in the wild. The likely attack vector is a local authenticated user who can invoke the Device Install Service. Because the flaw is purely an authorization issue, an attacker does not need network delivery or initial privileged access; they simply need to be logged on to the target machine to trigger the service and gain elevated privileges.