This vulnerability is a type confusion flaw in the Desktop Window Manager that allows an attacker with local authorization to manipulate type handling and elevate their privileges on a compromised Windows system or server. By exploiting the incompatibility in resource access, the attacker can gain higher privileges within the operating system, potentially granting full administrative control. The weakness is identified as CWE-843, indicating that the program uses an object of one type where another type is expected, leading to a security failure.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2019 (including Server Core install), Windows Server 2022, and Windows Server 2025 (including Server Core install).

The CVSS score of 7.8 classifies the flaw as high severity. No EPSS value is available, so the exact exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to have authorized access to a target machine. Once accessed, the type confusion can be leveraged to bypass privilege checks, providing the attacker elevated rights on the system.