This vulnerability arises from an incorrect permission assignment for a critical resource in the Windows Mobile Broadband component. An attacker who already has local access could exploit the flaw to gain higher privileges, potentially compromising system integrity and enabling further lateral movement. The weakness aligns with CWE-732, which involves improper access control on a resource that should be restricted.

Affected systems include Microsoft Windows 11 versions 24H2, 25H2, 26H2, and 26H1 running on ARM64-based hardware. The vulnerability specifically targets the Mobile Broadband feature that runs under local user contexts on these releases.

The flaw is assigned a CVSS score of 7.8, indicating high severity. No EPSS score is publicly available, and the issue has not been listed in the CISA KEV catalog, suggesting no documented exploitation yet. The vulnerability requires local user presence and is a local privilege escalation, so an attacker must first achieve local execution. Once obtained, elevated privileges could allow modification of protected system files, installation of malware, and the expansion of adversary capabilities across the network. Given the high impact of a local privilege escalation on a Windows desktop or embedded device, organizations should treat it as a significant risk.