The vulnerability originates from the release of an invalid pointer or reference within Windows Management Instrumentation (WMI). This flaw is a form of improper handling of memory references (CWE‑763) and permits an attacker who already has local access to obtain higher privileges on the affected system. Once exploited, the attacker can gain full control over the machine, enabling further malicious activities such as installing backdoors, escalating other user accounts, or modifying system configuration.

Affected installations include multiple Windows 10 releases (1607, 1809, 21H2, 22H2), Windows 11 builds (23H2, 24H2, 25H2, 26H2, 26H1), and a range of Windows Server editions (2012, 2012 R2, 2016, 2019, 2022, 2025) regardless of the core installation type. Both 32‑bit and 64‑bit architectures are impacted where the build supports them.

The CVSS score of 7 indicates medium severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is currently uncertain. The flaw requires local execution privileges; it is not remotely exploitable over a network. The primary attack vector is thus a local attacker with access to the target machine.