The vulnerability is a untrusted pointer dereference in the Windows COM+ Event System Service that can be triggered by an authenticated local user. This flaw, which is a CWE-822 (Untrusted Pointer Dereference), allows an attacker to gain higher privileges on the affected Windows machine, enabling arbitrary code execution under a system account. The impact is that compromised local processes can modify system files, install software, or otherwise subvert the operating system, which threatens confidentiality, integrity, and availability.

All current Windows releases from Windows 10 Version 1607 to Windows 10 Version 22H2, all Windows 11 releases from 23H2 through 26H2, and all Windows Server editions from Server 2012 to Server 2025 are affected. This includes both standard and server core installations, as well as ARM64 and x64 architectures.

The CVSS score of 7.8 indicates moderate severity. No EPSS score is reported and the vulnerability is not listed in CISA’s KEV catalog, suggesting low exploitation activity seen in the wild. The attack vector is local and requires an authenticated user with the ability to trigger the COM+ Event Service. Attackers would need to run a crafted payload locally to exploit the untrusted pointer dereference. Thus the risk is moderate but confined to systems where a malicious local user can be introduced.