The vulnerability is a type confusion flaw in the Windows Win32K component, where an attacker with local authorized access can manipulate resources of an incompatible type. This flaw results in the attacker gaining elevated privileges on the affected system, potentially allowing execution of code with administrative rights.

Affected Microsoft Windows products include Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1, and the Windows Server line — 2019, 2022, 2025 including Server Core installations.

The CVSS score of 7.8 marks this flaw as high‑severity, and although the EPSS score is not available, the lack of entry in CISA’s KEV catalog suggests no widespread exploitation has been observed yet. The likely attack vector is local, requiring the attacker to already have a user session on the compromised machine, after which the type confusion can be triggered to elevate to administrative rights.