Windows Kernel Elevation of Privilege Vulnerability

An attacker with local access to a Windows Server could exploit this kernel vulnerability to gain system-level privileges, potentially allowing them to modify control logic, alter process parameters, or disable safety interlocks on connected industrial equipment.

Windows Server administrators and operators at utilities, water authorities, and industrial facilities that run control systems, data acquisition servers, or historian platforms on Windows Server 2016, 2019, 2022, or 2025. Any server with local user access that connects to or manages programmable logic controllers (PLCs), human-machine interfaces (HMIs), or distributed control systems (DCS) is at risk.

An attacker must first gain local access to a Windows Server (e.g., as a standard user or service account) and then trigger a heap buffer overflow in the kernel to escalate privileges to SYSTEM level. Once elevated, they could execute arbitrary code with full control over the server and any connected OT devices or sensors.