This vulnerability is a buffer over‑read in the Windows Win32K subsystem that allows an authorized local attacker to read memory outside bounds and use that knowledge to elevate privileges to the level of the system. The flaw is rooted in CWE‑126, which enables attackers to gain total control over local resources, modify system configuration, install malicious software, or compromise protected data. The impact is therefore a high‑severity elevation of privilege that can lead to full system compromise for the affected host.

The flaw affects Microsoft Windows operating systems including Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both 32‑bit and 64‑bit platforms, as well as ARM64 variants, are impacted where applicable.

The Common Vulnerability Scoring System rates this vulnerability as High with a score of 7.0. The Exploit Prediction Score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalogue, indicating no confirmed public exploits at this time. Nevertheless, the attack requires a local process with code‑execution rights, so any user who can run malicious code on the machine faces a significant risk. The combination of a high CVSS score and potential local privilege escalation makes it prudent to treat this as a critical remediation item.