Windows Win32k Elevation of Privilege Vulnerability

An attacker with a local user account on an HMI, engineering workstation, or SCADA server could gain administrator privileges and run arbitrary commands with system-level access, potentially modifying process control logic or disrupting operations.

This vulnerability affects all supported versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. IT managers at utilities should prioritize patching HMI (Human-Machine Interface) computers, engineering workstations used for SCADA configuration, and domain controllers. Any Windows-based system running industrial software (Wonderware, FactoryTalk, etc.) is potentially at risk if an attacker obtains local user credentials or compromises a user's session.

An attacker with a valid local user account on a Windows system exploits a use-after-free bug in the Win32K graphics component to escalate from user privileges to system/administrator privileges. The attacker would need to trigger a specific code path in the graphics driver to cause memory corruption, then execute arbitrary code with elevated privileges.