An out‑of‑bounds read was discovered in the Windows Kernel (Win32k subsystem) that may allow a malicious local process to gain elevated privileges. The flaw arises from missing bounds checking when accessing memory, leading to a local privilege escalation that could compromise the entire system. This vulnerability is classified under memory corruption weaknesses such as CWE‑122, CWE‑125, and parameter validation errors (CWE‑20).

Microsoft’s analysis indicates that affected operating systems include Windows 10 versions 1809, 21 H2, and 22 H2; Windows 11 versions 24 H2, 25 H2, and 26 H1; and Windows Server 2019, 2022, and 2025, both standard and Server Core installations. The issue impacts processors running x86, x64, and ARM 64 architectures. Systems that have installed cumulative updates prior to the patch sequence are still vulnerable until the update is applied.

The CVSS score of 8.8 signals a high severity, while the EPSS score of less than 1 % indicates a low current exploitation probability. The vulnerability is not catalogued in CISA’s KEV, suggesting no widely known active exploits at the time of reporting. The likely attack vector is a local attacker who can run code with user privileges; the exploit requires no remote interaction, making it a purely local privilege‑escalation vector. Until remediation, any authenticated user could potentially abuse this flaw to reach system‑level privileges.