The vulnerability originates in Windows Assigned Access and involves improper control over code generation (CWE-94), effectively allowing a code injection scenario. An attacker who can authenticate to the system with local privileges can exploit this weakness to elevate their privileges and gain higher level access on the affected machine.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 (both x64 and arm64), 26H1; and Microsoft Windows Server 2019 (standard and Server Core). All these operating systems are listed by Microsoft as affected.

The CVSS score of 7.8 indicates a high severity. The EPSS score of 0.00745 indicates a very low exploitation probability, translating to roughly a 0.75 % chance of exploitation. The vulnerability is also not present in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local, with an attacker needing only a user account capable of launching Assigned Access scenarios to achieve privilege escalation.