The vulnerability is a untrusted pointer dereference in the Windows WebDAV component that permits an attacker with local webdav access to gain higher privileges on the affected system. This flaw is a classic memory safety issue (CWE-822) and can lead to unauthorized code execution or system takeover by escalated user credentials.

Affected products include Microsoft Windows 10 (versions 1607, 1809, 21H2, and 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1), and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, both standard and server core editions.

The CVSS score of 7.8 indicates high severity, though no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Likely, the attacker must first authenticate to the WebDAV service or otherwise have local server access; once authorized, the flaw can be triggered via specially crafted requests that exploit the pointer dereference, enabling local privilege escalation. The lack of publicly available exploit code may reduce immediate risk but the high severity warrants prompt attention.