Windows Win32k Elevation of Privilege Vulnerability

A user with local access to a Windows computer or server could exploit this buffer overflow vulnerability to gain administrative privileges and take full control of the system. In an OT environment, this means an attacker with physical or local network access could modify control logic, disable safety systems, or shut down critical processes.

This affects any organization running Windows 10, Windows 11, or Windows Server 2016–2025 systems that interact with OT networks. This includes engineering workstations, HMI (human-machine interface) servers, data historians, remote access jump hosts, and any Windows-based control system frontend. Water authorities and utilities using Windows for SCADA monitoring or plant management are affected.

An attacker must already have local user-level access to the Windows system (via RDP, physical access, or a compromised low-privilege account). They would trigger a heap-based buffer overflow in the Win32K driver through a specially crafted request, causing a crash that yields administrative-level code execution. This could then be used to modify HMI applications, PLCs, or historical data systems.