The vulnerability arises from improper access control in the Windows Win32K subsystem, allowing an entity with local authorization to elevate its privileges. The result is that a user who can execute code on a target machine may gain higher privileges than intended, potentially compromising system integrity and confidentiality.

Affected are Microsoft Windows 10 from Version 1607 through 22H2 and Windows 11 from Version 24H2 through 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. These include both 32‑bit and 64‑bit platforms as listed in the vendor/deployment matrix.

The high‑severity local privilege escalation reflected by the CVSS score of 7, coupled with an EPSS score of 3%, indicates a moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread attacks have been observed. An attacker must already have local access or a sufficient user context to leverage the improper access control in the Win32K subsystem, thereby gaining higher privileges and potentially compromising the integrity and confidentiality of the affected system.