Untrusted pointer dereference in SysInternals Process Monitor allows an authorized attacker to gain local privilege escalation, potentially compromising system integrity and confidentiality. The flaw stems from improper validation of a pointer value, fitting into CWE-822: Untrusted Pointer Dereference. If exploited, it enables the attacker to run code with higher privileges than the user account, leading to full system compromise without needing additional credentials.

The impact is confined to Microsoft Windows OS users who have installed the Sysinternals Process Monitor utility. No specific version numbers are supplied, so any older or unpatched installations of Process Monitor are vulnerable. The product is part of the Sysinternals suite offered by Microsoft for troubleshooting and monitoring Windows performance.

The reported CVSS score of 7.1 classifies this as a medium severity vulnerability, with an unknown EPSS score and no listing in the CISA KEV catalog. Exploitation requires local access with the ability to run Process Monitor, meaning an attacker must already have at least user‑level privileges on the machine. The likely attack vector is local, and the attacker can execute arbitrary code or elevate privileges after launching the vulnerable process.