Windows Kernel Elevation of Privilege Vulnerability

A user with standard Windows login credentials can exploit a flaw in the kernel to gain administrative-level access on the computer. On an HMI, engineering workstation, or historian running Windows, this could allow an attacker to alter or stop plant operations.

This affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems running on 32-bit, x64, and ARM64 architectures. Any OT asset using these operating systems—such as HMIs, engineering workstations, data historians, SCADA servers, or supervisory control systems—needs attention.

An attacker with a local login account (such as a contractor, temporary worker, or compromised user account) can execute code that triggers a use-after-free condition in the Windows kernel, escalating to system-level privileges. This does not require network access; the attacker must have interactive access to the machine or be able to execute code locally after gaining initial access via another method.