This vulnerability is a pointer dereference flaw in the Windows Win32 Kernel Subsystem. An attacker who already has access to the system can craft a request that causes the kernel to dereference a malicious pointer, allowing the attacker to execute code with system privileges. The flaw falls under CWE‑822 and results in unauthorized privilege escalation within the local machine.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2 through 26H2, including ARM64 and x64 builds; Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations.

The CVSS base score is 7.8, indicating a high severity. EPSS is not available, so the exact exploit probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by a local attacker who is authenticated to the system and has permissions to execute arbitrary code, such as a local user or service with elevated rights. No public exploit exists as of the latest advisory, but the high severity and lack of broader vendor mitigation advisories mean this is a critical patching priority.