This vulnerability, identified as CWE-59 (Improper Link Resolution Before File Access), affects the Windows Resilient File System (ReFS) Deduplication Service in Windows 11 Version 24H2 (build 10.0.26100.0). It allows a local attacker with some level of authorization to exploit improper handling of symbolic links or similar link types before file access, resulting in privilege escalation. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected system, potentially gaining higher-level access than intended. This can compromise system confidentiality, integrity, and availability.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83999. No additional mitigation steps are indicated by the vendor advisory.