Improper authorization in Windows Encrypting File System (EFS) permits an authorized local user to tamper with encrypted data. The flaw allows manipulation of EFS metadata or encryption keys, potentially causing data corruption or denial of access to legitimate users. While the confidentiality of the data remains protected by encryption, integrity and availability are at risk if the tampering changes or renders files unusable.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Microsoft Windows Server editions 2016, 2019, 2022, and 2025 are affected.

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score is not available, implying limited evidence of active exploitation. The vulnerability is listed as not in the CISA KEV catalog. Attackers would need local, authorized credentials to exploit this issue; no remote or privilege‑escalation vectors are documented. Successful exploitation could lead to data integrity breaches or denial of service for affected systems.