The vulnerability stems from a missing authentication check for a critical function within Windows Push Notifications, allowing a local attacker who has legitimate access to the machine to elevate privileges. This flaw can potentially give an attacker full control over the affected system, and it is identified as CWE‑306.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019 (standard and Server Core), Windows Server 2022, Windows Server 2025 (standard and Server Core).

The CVSS score of 7 indicates a medium‑to‑high severity local privilege escalation. The EPSS score is less than 1%, indicating a very low probability of exploitation. This issue is not listed in the CISA KEV catalog. The attack vector is local, requiring an attacker to already have some user access on the target machine. Once the function is exploited, the attacker can bypass authentication controls and gain elevated privileges, potentially compromising confidentiality, integrity, and availability of the system.