An authenticated local attacker can leverage a missing authorization flaw in the Windows StateRepository API to achieve unauthorized system tampering with high impact.

This is a missing authorization vulnerability (CWE-862) occurring within the Windows StateRepository API. An attacker with local access and low privileges can exploit this flaw to manipulate system state information, potentially leading to a full compromise of system integrity.

The ability for an authenticated attacker to perform unauthorized tampering with the StateRepository API presents a significant risk to system integrity and stability. Given the CVSS score of 8.8, this vulnerability is classified as High severity because it allows for total technical impact, including the potential for privilege escalation or the modification of critical system settings. Successful exploitation could lead to unauthorized system changes, disruption of services, or the persistence of malicious configurations.

Immediate Action: Apply the relevant security updates provided by Microsoft in the official update guide to address the authorization flaw.

Proactive Monitoring: Monitor system logs for unusual modifications to registry keys or local database files associated with the StateRepository service.

Compensating Controls: Implement strict local access control policies and utilize endpoint detection and response tools to identify and block unauthorized attempts by low-privileged users to interact with sensitive system APIs.

Public Exploit Available: Unknown

Organizations should prioritize the deployment of the security updates provided by Microsoft for all affected Windows versions. Because this vulnerability is locally exploitable and carries a high severity rating, it is critical to ensure that all endpoints are fully patched to mitigate the risk of local privilege escalation or system state manipulation.