The flaw stems from improper resolution of symbolic links in the Windows Registry before a file is accessed, enabling an attacker who has legitimate registry permissions to modify entries that cause the system to perform actions with elevated rights.

Microsoft Windows 10 through versions 21H2 and 22H2, Microsoft Windows 11 in versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Microsoft Windows Server 2022 and Windows Server 2025 (including Server Core installations) are affected.

The CVSS score of 7.8 indicates high severity, but the EPSS is not available, limiting insight into current exploitation probability. Because the issue requires local access with registry write permissions, the likely attack vector is a local privilege escalation; the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Nevertheless, the potential to raise privileges locally warrants prompt attention.