The vulnerability is an out‑of‑bounds read in the Windows Desktop Window Manager (DWM) Core Library. The flaw allows an attacker with local, authorized access to read memory beyond array bounds, which can be leveraged to elevate privileges. The resulting local privilege escalation could enable the attacker to bypass user restrictions and gain administrative rights.

Affected systems include Microsoft Windows 10 from version 1607 through 22H2, and Windows 11 from version 23H2 to 26H2, across x86, x64, and arm64 architectures. Windows Server 2016, 2019, 2022, and 2025, including Server Core installations, are also impacted. All versions listed by Microsoft constitute targets for the vulnerability.

The CVSS score for this local privilege escalation is 7.8, indicating moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local or authorized credentials to exploit the bug, and the described misuse does not involve a remote entry point. The lack of a publicly disclosed exploit or CWEs beyond CWE-125 suggests that the opportunity for exploitation may be limited to privileged local users, but the impact remains serious if the attack succeeds.