A pointer dereference in Windows Security Support Provider Interface permits an attacker with local legitimate access to elevate permissions to an administrative level. The flaw can enable execution of arbitrary code or actions that are normally restrained by standard user rights, thereby compromising confidentiality, integrity, and availability of the impacted machine. The weakness falls under CWE-822, which deals with untrusted pointer dereference.

Affected Microsoft products include Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, across both x86 and x64 architectures where listed.

The CVSS score of 7 denotes a moderate severity, and the exploit probability (EPSS) is not available, indicating insufficient data on current exploitation prevalence. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploits yet. The likely attack vector is a local authorized user who can run arbitrary code, making this a local privilege escalation vector rather than a remote attack. Given the moderate severity and potential for significant local damage, prompt remediation is warranted.