An improper neutralization of special elements in output leads to an injection flaw in Microsoft’s Azure Storage Library. The flaw enables an attacker who is already authorized to an Azure Storage resource to elevate privileges over the network, potentially granting broader access to storage accounts or other affected components. The weakness is a classic injection issue, classified as CWE‑74.

The vulnerability affects the Microsoft Azure Storage Blobs client library for Java and the Azure Storage Blob Batch library. No specific version details were supplied in the CNA data, and the issue likely applies to a range of releases that include the affected code paths.

The CVSS score of 8.1 places the vulnerability in the high severity range. EPSS is not available, but the requirement for an authorized attacker suggests the risk is not entirely high probability unless the attacker bypasses existing authentication controls. The vulnerability is not currently listed in the CISA KEV catalog, indicating it has not yet been widely exploited. Inferred attack vectors involve a network‑connected authorized user exploiting the flawed data handling in the client library.