An OLE type confusion flaw in Windows permits a locally authorized attacker to supply an incompatible data type that leads to privileged operations. The vulnerability resides in the object linking and embedding subsystem, allowing elevated privileges without executing arbitrary code. The flaw is a type‑confusion issue identified as CWE‑843, providing local privilege escalation.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition, across both standard and Server Core installations.

The CVSS v3 score of 7.8 indicates a high severity local exploitation risk. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. Attackers need only a legitimate local account or authorization to run code. Once type confusion is triggered, privileges are escalated, enabling full administrative control. Because any authenticated user can exploit the flaw, the risk to organizations is significant until the patch is applied.