An integer overflow or wraparound in the Windows Kernel grants an attacker with local, authorized access the ability to elevate privileges. This flaw, classified as CWE-190, enables the affected user to restrict or corrupt kernel memory in a way that the system will accept higher‑level privileges for that session, potentially compromising confidentiality and integrity of the entire machine.

Affected Microsoft Windows releases include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, as well as 26H1; and Windows Server 2012 through 2025, including all Server Core variants. The CVE details list a broad set of versions without providing granular patch status for each build.

The CVSS score of 7.8 signals high severity, and the vulnerability is not yet listed in CISA’s KEV catalog. Because the flaw requires local, authenticated execution, the attack vector is limited to users who already have legitimate access. Based on the description, it is inferred that an attacker would exploit the overflow by delivering crafted input with an authorized account; no publicly documented remote exploitation exists at this time, and the EPSS score is not available to indicate current exploit probability.