This vulnerability (CVE-2025-21202) affects Microsoft Windows 10 Version 1507 (build 10.0.10240.0) and is classified under CWE-284 (Improper Access Control). It specifically impacts the Windows Recovery Environment Agent, allowing elevation of privilege due to insufficient access control. The CVSS 3.1 base score is 6.1, with an attack vector of physical access (AV:P), low attack complexity, no privileges required, and no user interaction. Confidentiality and integrity impacts are high, with no impact on availability. Microsoft has published an official fix for this vulnerability as detailed in their security update guide.

An attacker with physical access to a system running the affected Windows 10 Version 1507 could exploit this vulnerability to gain elevated privileges, potentially compromising system confidentiality and integrity. There is no known exploitation in the wild at this time. The vulnerability does not affect system availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as referenced in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21202) to remediate this vulnerability.