The flaw is an improper authorization in the Windows Portable Device Enumerator Service that permits a local attacker with sufficient access rights to gain higher privileges on the machine. Because the service incorrectly validates its caller, an authorized user can potentially exploit this to elevate privileges and gain administrative rights, enabling additional attacks such as installing malware or modifying system settings. This weakness is categorized as CWE-59.

This issue impacts Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2, and Windows Server releases ranging from Server 2012 (including Core installations) through Server 2025 (including Core installations). All these releases are enumerated as affected by the Microsoft advisory.

The vulnerability scores a CVSS of 7.8, indicating high severity for local privilege escalation. The EPSS score is currently unavailable, so the exact probability of exploitation cannot be quantified from this data. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to be authenticated or have some local access on the target system, making the exploitation scenario likely for users who already have limited action on the machine. Successful exploitation could allow an attacker to take on system-level privileges and execute arbitrary code with elevated rights.