The vulnerability stems from a type‑confusion flaw in the Windows DWM Core Library. An attacker who already has local user privileges can gain access to a resource with an incompatible type, effectively bypassing normal access controls. The flaw is categorized as CWE‑122 and CWE‑843, reflecting heap‑based buffer overread and type confusion, and it allows the attacker to elevate privileges on the affected machine, compromising system integrity and confidentiality.

This issue affects numerous Windows editions, including Windows 10 build 1607, 1809, 21 H2 and 22 H2, Windows 11 build 23 H2, and Windows Server 2016, 2019 and 2022, whether installed on a full desktop environment or as a Server Core deployment.

The CVSS score of 7.8 indicates moderate to near‑high severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an authorized user or a user with sufficient access to run code that interacts with the Desktop Window Manager. An adversary can exploit the flaw by executing locally privileged code that triggers the type confusion in DWM, thereby elevating their privileges. The risk to an organization hinges on physical or local access to the affected systems and on the presence of vulnerable user accounts.