Desktop Window Manager performs a type confusion when accessing a resource, allowing an attacker with local authorization to elevate privileges. This flaw can be abused to gain higher rights on the same machine, enabling access or modification of restricted resources and potentially full system compromise. The vulnerability is rated CVSS 7.8, indicating a high risk to confidentiality and integrity for affected users.

Affected products include Microsoft Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Microsoft Windows Server 2019 (both full and Server Core), Windows Server 2022, and Windows Server 2025 (both full and Server Core).

The CVSS score of 7.8 identifies this flaw as a high‑severity local privilege escalation. No EPSS score is published, so exploitation probability is unknown, but the vulnerability has not yet been reported in the CISA KEV catalog. Attackers would need local access and legitimate credentials or the ability to trigger the type confusion via a crafted input within Desktop Window Manager. Given the lack of public exploit evidence, the risk remains theoretically high for systems that run the affected OS versions.