A type‑confusion flaw in certain Windows kernel‑mode drivers allows a component to treat a memory buffer as a different object type. An attacker who can supply crafted input to the driver can cause the kernel to execute unintended operations, enabling the attacker to run code with elevated system privileges.

This flaw affects Microsoft Windows 11 24H2, 25H2, 26H1 (both ARM64 and x64) and Windows Server 2025, including Server Core installations. The vulnerability is exploitable by a locally authenticated user with write access to the affected driver.

The CVSS score of 7.8 classifies this vulnerability as high severity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, indicating that no widespread, publicly known exploits have been observed. Nevertheless, the attack requires local, authorized access and leads to full kernel‑privilege escalation, making it a significant risk for organizations that have not applied the Microsoft update.