The vulnerability in Windows Resource Management (MRM) is an integer overflow or wraparound that allows a user with authorized local privileges to elevate their privileges. The flaw operates when MRM processes certain inputs that exceed expected bounds, resulting in memory corruption and an escalation of the caller's rights. This can lead to unrestricted access to system resources and potentially full control over the affected system if exploited.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and Server Core installations.

The CVSS base score of 7.8 indicates high severity, and the EPSS score is unavailable, making the exact likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized user to supply crafted inputs to MRM, which could trigger the integer overflow and lead to privilege escalation on the target machine.