Improper access control within Windows kernel‑mode drivers allows an attacker who already has authorized local access to elevate privileges and assume the rights of a higher privileged user. The weakness is a manifestation of improper permission assignment and can lead to unauthorized manipulation of system files, installation of malware, and full control over the affected system, thereby compromising confidentiality, integrity, and availability.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 7.8 classifies this as a high‑severity vulnerability, and although EPSS data is not available, the lack of a KEV listing suggests no widespread, in‑the‑wild exploitation yet. The attack vector is inferred to be local, requiring an attacker who already holds some level of authorized access. Exploitation would involve loading a kernel‑mode driver that contains the flawed access control logic. Given the kernel’s authority, privilege escalation can occur without additional network access or privilege escalation techniques.