An out‑of‑bounds write in the Windows Kernel can be triggered by an authorized local user, providing the means to elevate privileges to a higher level. The flaw is classified as CWE‑787 and can compromise the integrity of the system by granting elevated rights.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including all Server Core installations

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so no evidence of widespread exploitation. The attack requires local, authorized access, making the vector local. The high severity and possibility of granting elevated rights mean a significant risk for affected systems, though the lack of remote exploitation reduces the immediate threat to network users.