A local authorized attacker can exploit a type confusion vulnerability in the Windows Input System to elevate privileges. The flaw occurs when input data is processed with an incompatible type, causing the system to incorrectly treat the input as an object with higher privileges, mapping to CWE-843. The impact is an elevation of access rights, enabling the attacker to perform actions normally reserved for more privileged users.

The vulnerability affects multiple Windows 10 releases (Version 1809, 21H2, 22H2), Windows 11 releases (Versions 23H2, 24H2, 25H2, 26H2, 26H1 and a duplicate 23H2 entry), and Windows Server platforms (2019, 2022, 2025, each including the Server Core installation). These versions are listed by the CNA and are also represented in the CPE identifiers.

The CVSS score of 7.8 indicates high severity, though the EPSS score is not available and the vulnerability is not listed in the KEV catalog. The attack vector is local and requires an authorized user; once exploited, an attacker can increase privileges within the system. Because no public exploit code is documented, the likelihood of exploitation remains dependent on the presence of authorized local access and the timeliness of applying the patch.