An untrusted pointer dereference in the WebDAV subsystem allows an attacker who already has authorized local access to elevate privileges. This flaw can be exploited to gain higher privileges on the affected Windows host, enabling the attacker to modify or read protected data, install or remove software, and perform other sensitive operations that could compromise confidentiality, integrity, and availability of the system.

Microsoft Windows 10, including versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11, including versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012 through 2025, including all core and full installations.

The CVSS score of 7.8 classifies the vulnerability as High, indicating significant impact if exploited. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, with an authorized user or attacker who has some existing access privileges on the system. No remote exploitation or prerequisite conditions are described in the available description.