The vulnerability is an improper privilege management flaw in the Python runtime that allows a user with local authorization to gain elevated privileges. The flaw is described as a privilege escalation vulnerability (CWE-641), meaning that the attacker can transform their current low‑level access into higher privileged access without moving outside their local context. If successful, the attacker could install software, modify system settings, or otherwise gain control that would normally be restricted to administrators.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2012 (including core), 2012 R2, 2016, 2019, 2022, and 2025 are listed as affected. All builds identified by the accompanying CPE strings are susceptible.

The CVSS score of 7.8 indicates a high severity local attack. The EPSS score is unavailable, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is a local authorized user who can run Python code; no network or remote access is required. Once the attacker gains elevated privileges, they can maintain persistent access or further compromise the system. Given the high CVSS rating and the fact that the flaw resides in a widely used language runtime, the risk level is significant for organizations running the affected Windows versions.