The flaw resides in the Windows Common Log File System Driver. It allows an attacker with local authority to inject operations from an untrusted domain into the driver’s privileged code path. This injection can raise the attacker’s privilege level, enabling access to system resources normally restricted to administrators. The weakness is a form of principle-of-privilege escalation identified as CWE‑829.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Microsoft Windows Server 2012 through 2025 (including Server Core variants).

The CVSS score of 7 indicates a high-severity vulnerability. While no EPSS score is provided, the lack of a KEV listing suggests no publicly deployed exploits are known. Attack requires local authorization and relies on inclusion of untrusted control sphere code. Even so, an attacker who can execute code locally can leverage the flaw to gain elevated privileges.