Windows Kernel Elevation of Privilege Vulnerability

A user logged into a Windows system could exploit this to gain administrative access, potentially allowing them to modify control logic, disable monitoring systems, or disrupt normal operations on HMIs and engineering workstations.

This affects any organization using Windows 10, Windows 11, or Windows Server 2022/2025 as HMI (human-machine interface) systems, engineering workstations, or data historian servers. Particularly critical for organizations where these workstations have privileged access to control systems or network connectivity to PLCs and safety systems.

An attacker with an active user account on the system executes specially crafted code that triggers the heap-based buffer overflow in the Windows Kernel, elevating their privileges from standard user to administrator or system level. This could then be used to modify sensitive settings on OT systems managed from that workstation.