Microsoft Kinect's improper access control permits an attacker who has local access to a system with a Kinect device to bypass standard permission checks when interacting with the Kinect driver or services. This flaw enables the attacker to gain elevated privileges on the host, allowing the execution of code with higher authority. The resulting local privilege escalation could enable an attacker to modify system settings, access all local data, or use the system as a foothold for further network compromise.

Windows 10 version 1607 through 22H2, Windows 11 versions 23H2 to 26H1, and Windows Server releases from 2012 to 2025 (including both standard and Server Core installations) are affected wherever Kinect hardware or its driver stack is present and active.

The CVSS score of 7.8 categorizes this vulnerability as high severity. The flaw requires the attacker to already have local, authorized access and a Kinect device on the machine, which limits the attack surface to environments where such hardware is used. No EPSS metric is reported, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation to date. Organizations with unpatched systems and Kinect devices should treat this as a critical local privilege escalation risk.