A relative path traversal flaw in the Windows Shell lets an authorized local attacker elevate privileges. The vulnerability, identified as CWE-23, allows abuse of the shell’s file handling logic to access or overwrite files it should not ordinarily reach, potentially enabling a non‑admin user to gain higher privileges on the affected machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including server core installations).

The CVSS score of 7.8 classifies this as a high‑severity local privilege escalation. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is a local authorized user who can launch the Windows Shell. If the flaw is triggered, the attacker could execute code with elevated rights on the victim system.