Improper access control in the Windows Bind Filter Driver permits an authorized local user to gain higher privileges; the flaw allows privilege escalation due to missing authorization checks (CWE-863). An attacker who can install or load the driver from a privileged context can elevate to system level, compromising confidentiality, integrity, and availability of the affected machine.

Microsoft Windows 11 version 23H2 (both arm64 and x64 editions) and Microsoft Windows Server 2025, including Server Core installations, are affected by this bug. Vehicles that run the Bind Filter Driver as part of the operating system kernel are the ones at risk.

The vulnerability carries a CVSS score of 8.8, indicating high severity. An EPSS score is not available, and the flaw is currently not listed in the CISA KEV catalog, but it remains exploitable by a local user with sufficient privileges. The likely attack vector is a local, authorized attacker that can load or modify drivers, which is a realistic threat if an attacker can gain user-level access. The impact is a complete local privilege escalation, granting the attacker full control over the affected system.