The vulnerability is a flaw in how Windows Management Instrumentation deserializes data. Because the system accepts data that has not been trusted, an attacker who has local, authorized access can inject crafted data that is processed during deserialization, resulting in code execution that lifts their privileges. This flaw maps to CWE‑502 and can lead to full local privilege escalation.

Affected Windows releases include Windows 10 starting with version 1607 through 22H2, all listed Windows 11 releases such as 23H2, 24H2, 25H2, 26H2, 26H1, and recent Windows Server editions from 2012 to 2025, including the Server Core installations. The vulnerability is present in the core operating system and in the WMI subsystem across these versions.

With a CVSS base score of 7.8, the vulnerability is considered high severity. The EPSS score is 2%, and it has not been listed in CISA’s KEV catalog. Because the attack requires an attacker with local authorized access, the risk is limited to environments where privileged users are potentially compromised. Administrators should apply the Microsoft security update immediately to mitigate this local privilege escalation path.