An incorrectly enforced authorization check in the Windows SMB client allows an attacker who already has local authorization to bypass a security feature. This flaw can enable the attacker to perform actions that should be restricted, effectively lifting the intended protections and potentially exposing the system to additional attacks. The weakness is rooted in a user‑controlled key authorization bypass, as identified by CWE‑863.

The vulnerability affects the Windows SMB client on multiple Microsoft operating systems, specifically Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and Windows Server editions 2022 and 2025 (including the Server Core installation). No specific patch level or build information is provided, so all listed releases are potentially impacted until a fix is applied.

The CVSS score of 5.5 indicates a moderate severity, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The attack requires a local attacker with legitimate authorization and depends on the SMB client’s execution context. Because the flaw permits bypass of an internal security feature, it could act as a stepping stone for further exploitation, but current evidence suggests that exploitation is unlikely without additional privileged conditions.