The vulnerability is a result of an externally‑controlled format string in Windows Image Acquisition. An authorized attacker can supply crafted data that is processed by the imaging component, enabling the attacker to gain privileges higher than the original process. This flaw is an instance of CWE‑134 and can lead to arbitrary code execution with elevated privileges on the affected Windows system.

Microsoft Windows 10 21H2 and 22H2, Microsoft Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1, plus Microsoft Windows Server 2025 (including Server Core installations). The affected builds cover x86, x64, and arm64 architectures as indicated by the CPE listings.

The CVSS score of 7.8 places this issue in the high‑severity range for local privilege escalation. No EPSS score is currently available, and the flaw is not listed in the CISA KEV catalog. It is inferred that the attack vector is local only, requiring the attacker to be authorized to run processes on the target system. Under those conditions, an attacker could trigger the flaw by delivering specially crafted image data or invoking the relevant APIs, resulting in arbitrary code execution with the privilege level of the targeted process.