The vulnerability is an out‑of‑bounds read in the Windows DWM Core Library that permits any user who has authorized access to a system to elevate their privileges locally. The flaw arises from the library reading beyond the bounds of a buffer, allowing a malicious client to influence the privileges granted to a process. Because the vulnerability is local and requires the attacker to run code on the target machine, it constitutes a local privilege escalation detectable by the CWE‑125 classification.

Affected Microsoft products include Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2 and 26H2, and the corresponding Windows Server releases 2019, 2022 and 2025, both standard and Server Core installations. All of the listed releases run on x86, x64 or arm64 architectures as indicated by the CPE identifiers.

The CVSS score of 7.8 indicates a high severity impact, whereas no EPSS score is available; the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits to date. The attack requires only local authorized access, meaning the threat is most acute for users on the affected machines. If an attacker can run code on a compromised account, the out‑of‑bounds read can be leveraged to elevate that account’s privileges, potentially compromising the entire system.