An integer overflow or wraparound flaw exists in certain Windows kernel‑mode drivers. When a locally‑running, authorized process invokes the vulnerable routine, the arithmetic error causes the driver to miscalculate an internal counter, allowing the attacker to obtain higher privileges within the system. The impact is the ability to execute code with kernel‑level authority, potentially compromising all local data and services.

Affected Microsoft products include Windows 10 releases 1607, 1809, 21H2, 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both full and Server Core variants. All listed configurations contain the vulnerable kernel‑mode drivers and therefore are at risk.

The CVSS score of 7.8 classifies this flaw as high severity. EPSS data is not available, so the likelihood of exploitation is uncertain; it has not been reported in the CISA KEV catalog. Because the flaw requires local authenticated access, the most probable attack vector is a legitimate user or a privileged process that can load or execute the problematic driver. No public exploit is known at this time, but the high severity and local privilege escalation potential elevate the risk to organizations that deploy the affected Windows versions.