The Windows CD-ROM Driver vulnerability arises from a type confusion flaw, where a resource is accessed with an incompatible type, enabling a local, authorized attacker to gain elevated privileges. This flaw falls under CWE‑843 and allows the attacker to run code with higher privileges than the user originally possessed. The impact is direct elevation of privilege that can compromise the entire system, allowing modification of critical system settings, installation of malware, and access to sensitive data. The nature of the weakness is a classic type confusion that breaks strict type safety in the driver, leading to unauthorized code execution. The vulnerability's description indicates that it requires local authorization but does not constrain the attack from a network or remote context, meaning any user with local access can leverage it once the driver is compromised.

Affected systems include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server releases spanning 2012 to 2025 across standard and core installations. All listed editions are impacted, irrespective of processor architecture or installation type, as the driver component is common across these platforms. This broad coverage encompasses legacy servers as well as recent desktop operating systems.

The CVSS score of 7.8 indicates a high severity, while the EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog. From the description, it is inferred that the attack vector is local: an authorized user must have access to the system to exploit the type confusion in the CD‑ROM driver. The exploit likely requires the user to trigger specific driver operations that trigger the type mismatch, leading to privilege escalation. Because the flaw is local and does not require special network exposure, the potential for compromise is high on systems where the CD‑ROM driver is present and where users are not strictly limited to least privilege. The combination of high severity, lack of mitigation in most systems, and the broad scope of affected platforms elevates the overall risk for organizations with many Windows 10, Windows 11, or Windows Server installations that have CD‑ROM hardware or the associated driver loaded.