An authorized local user can exploit an improper verification of cryptographic signatures in the Windows Update Stack. The flaw allows the attacker to forge update artifacts, thereby tricking the system into accepting and installing unauthorized code. This constitutes a spoofing vulnerability that can compromise the integrity of software updates and serve as a foothold for further malicious activity.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 across x86, x64, and arm64 architectures.

The CVSS score of 5.5 indicates moderate risk. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local authorized access to tamper with the update stack; remote exploitation is not supported by the disclosed information. Once an attacker succeeds, the spoofed updates can elevate privileges or introduce malware under the guise of legitimate packages.