The vulnerability is an improper access control in Windows kernel‑mode drivers that enables an attacker with local privilege to elevate their rights. The flaw resides in the driver’s permission checks, allowing a local user or process that can load a driver to bypass the expected access restrictions. An attacker can obtain SYSTEM privileges, effectively gaining full control over the affected system.

Affected products are Microsoft Windows 11 24H2, 25H2, 26H1, and 26H2 for both x64 and arm64 architectures, as well as Windows Server 2025 and its Server Core installation. The flaw impacts all builds that include the vulnerable kernel‑mode drivers listed in the update guide. No specific sub‑versions are enumerated beyond the general build numbers.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog as of this analysis. Attackers must have local access to the system and sufficient privileges to load or interact with the kernel‑mode drivers, making the attack vector local. If the affected drivers are not patched, an attacker could gain full system control.