An integer underflow within the Windows NT OS Kernel enables a local attacker with authorized access to elevate privileges. The flaw can cause a wraparound condition that potentially leads to privilege escalation by granting the attacker higher privileges. The impact is confined to operating within the local system context and does not automatically provide network or remote execution capabilities.

The vulnerability affects Windows 10 build 1607, 1809, 21H2 and 22H2, Windows 11 builds 23H2, 24H2, 25H2 and 26H1 (including arm64 and x64 releases), and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations.

With a CVSS score of 7.8, the flaw is classified as high severity. The EPSS score of 6% indicates a moderate probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user that can execute code or otherwise obtain temporary elevated rights; it does not rely on network or remote code execution. Once triggered, the privilege escalation can be used to compromise local resources or pivot to higher-level administrative functions.