The vulnerability is an out-of-bounds read in the Windows Spaceport.sys driver that permits an attacker who already has local access to elevate privileges. The flaw is categorized as CWE-125 and allows reading memory beyond the intended bounds, thereby enabling privilege escalation. The impact is a gain of privileged local rights, which can lead to full system compromise if administrative rights are achieved.

Affected platforms include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2; as well as Windows Server 2019, Windows Server 2022, and Windows Server 2025 in both full and Server Core installations. These releases are listed as impacted in the official CVE advisory.

The CVSS score of 7.8 indicates high severity of privilege escalation. The EPSS score of <1% signals a very low but non-zero probability of exploitation, and the CVE is not listed in the CISA KEV catalog, implying no confirmed widespread use. Based on the CVE description, it is inferred that an attacker must already possess local access to trigger the out‑of‑bounds read in Spaceport.sys, which would allow elevation of privileges without further compromise.