A relative path traversal flaw in the Windows Internet component (wininet.dll) lets an attacker with authorized access modify or replace local files used by the operating system. The vulnerability can be leveraged to tamper with trusted files, potentially altering application behavior or facilitating further compromise. The weakness falls under CWE‑23, which pertains to incorrect handling of relative paths, leading to integrity violations.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, all Windows 11 releases from 23H2 to 26H2 (including 26H1), and Windows Server 2012 through 2025, both full and core installations, are all affected.

The CVSS score of 4.7 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation data at present. Exploitation requires that the attacker already has authorized local or administrative access, making the attack vector local. If an attacker can execute privileged code or has write access to system directories, path traversal can be used to tamper with local files, potentially impacting confidentiality and integrity but not enabling remote code execution.