This vulnerability arises from improper access control in the Windows Host Guardian Service. An attacker who has local presence or authorized access can exploit this issue to elevate privileges on the host. The flaw permits the attacker to gain higher authority, potentially compromising the system’s confidentiality, integrity, and overall security. The weakness is classified as CWE-59, which deals with improper handling of privileged access.

The flaw affects Microsoft Windows 10 versions 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 and the 26H1 release, as well as Windows Server editions 2019, 2022 and 2025, including Server Core installations. All listed architectures, including x86, x86‑64 and ARM64 based systems, are potentially impacted.

The CVSS score is 7.8, indicating high severity, but the EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local and requires the attacker to have some local or authorized access to the host. Given the high severity and the lack of known widespread exploitation, the risk remains significant for environments that host the Windows Host Guardian Service without adequate privilege confinement.