The vulnerability in Microsoft PowerToys allows an authorized local attacker to modify configuration settings that are not properly restricted, enabling elevation of privileges. This flaw permits a user who can change PowerToys configuration to gain higher-level access on the system, potentially allowing them to execute arbitrary code with elevated rights. Using the background of an improper limitation of system settings (CWE-15), this flaw exposes a clear path for privilege escalation if an attacker can influence PowerToys configuration files or parameters.

Microsoft PowerToys for Windows is affected. All releases prior to the recent security update contain the flaw; refer to the Microsoft Security Update Guide for the specific versions that have been patched. The vulnerability impacts systems running any unpatched PowerToys installation on Windows platforms.

The CVSS score of 7.3 indicates a high severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitation probability appears moderate. The attacker model requires local access and the ability to modify PowerToys settings, meaning that an authenticated local user or one who can manipulate configuration files could exploit the flaw. No special conditions or zero‑day components are reported, so the risk is contained to environments where local users have unnecessary write access to PowerToys configuration.