An improper privilege management flaw in the Windows Internet component, wininet.dll, permits an authorized local attacker to perform spoofing actions, effectively allowing the malicious application to masquerade as another trusted source. The vulnerability stems from inadequate enforcement of security privilege boundaries, which is classified as CWE‑290. This could enable a local attacker to trick the system or other applications into trusting forged network requests, potentially compromising the integrity of data and the authenticity of communications.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2022 and Server 2025 (including Server Core installations) are affected by this issue.

The CVSS score of 8.4 indicates a high severity level, and while the EPSS score is not available, the lack of a remote exploitation path suggests the attack vector is local and requires privileged access. The vulnerability is not listed in the CISA KEV catalog, meaning there is currently no publicly known exploit; however, any user with elevated rights who can run untrusted code could potentially exploit the flaw, so the risk is significant for environments that allow local administrators to install or run software.