The flaw is an untrusted pointer dereference in the Windows COM+ Event System Service. A locally authorized attacker can trigger the vulnerability and elevate privileges on the affected system, potentially gaining administrative rights and executing arbitrary code. This can compromise system integrity and confidentiality by allowing an attacker to modify configuration, install malicious software, or access sensitive data.

Affected systems include Microsoft Windows 10 build versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 build versions 23H2, 24H2, 25H2, 26H1, 26H2; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations. All listed versions run the COM+ Event System Service without the patch, leaving them vulnerable.

The CVSS score is 7.8, indicating a high severity vulnerability, while the EPSS score is not available and it is not listed in the CISA KEV catalog. The attack vector is local: an attacker must already have some level of authorized access on the device to invoke the flawed service. Once the pointer dereference is triggered, the attacker can elevate privileges and gain unconstrained local access, which, without additional defenses, could lead to full system compromise.