The vulnerability stems from weak authentication controls in Microsoft’s Input Method Editor (IME). An attacker who already has access to a user account can exploit this flaw to elevate privileges locally on the affected Windows system. The attack can allow the compromised party to acquire higher‑level rights and potentially execute arbitrary code as an elevated user, impacting confidentiality, integrity, and availability on the host.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012 (full and core), 2012 R2 (full and core), 2016, 2019 (full and core), 2022, and 2025 (full and core). All listed editions are affected unless the operating system has applied the remediation update.

The CVSS score of 7.8 indicates a moderate‑to‑high severity for local privilege escalation. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited empirical exploitation data at this time. Attackers would need a local presence or an authenticated session with a user account; remote exploitation is unlikely based on the description. The weakness is tied to improper authentication within the IME component, so the exploitation requires triggering the vulnerable authentication path, which typically requires interaction with the input method interface.