Windows Kernel Elevation of Privilege Vulnerability

An attacker with a user account on the system could exploit this kernel vulnerability to gain administrative privileges, potentially allowing them to install malware, modify system configurations, or interfere with OT applications running on the server.

Windows Server 2025 and Windows 11 (all versions including 24H2, 25H2, and 26H1 for both x64 and ARM64 architectures). This affects any OT engineering workstations or control servers running these operating systems, particularly those used for HMI, data historians, or support systems.

An attacker must first obtain a local user account on the affected Windows system. Once authenticated, they can trigger an untrusted pointer dereference in the Windows kernel to escalate privileges from user-level to administrator/system-level. This direct local attack requires no network traversal but assumes prior account compromise.