This critical privilege escalation vulnerability in the Windows Kernel is currently being exploited in the wild and poses a severe risk of unauthorized system-wide control.

The flaw is a race condition (CWE-362) and double free (CWE-415) within the Windows Kernel. It allows an attacker who already has low-level authenticated access to the system to manipulate shared kernel memory structures to achieve SYSTEM-level execution.

With a CVSS score of 9.5, this vulnerability represents an extreme risk to organizational infrastructure. Successful exploitation allows a local user to bypass all security boundaries, granting full administrative control over the host. This facilitates complete system compromise, potential data exfiltration, and provides a critical path for attackers to move laterally across the network after an initial foothold.

Immediate Action: Apply the relevant security updates provided by Microsoft in the official update guide as soon as possible to patch the kernel synchronization logic.

Proactive Monitoring: Review system logs for unusual kernel-mode crashes or unexpected privilege escalation events, particularly those originating from low-privileged service accounts.

Compensating Controls: Ensure robust endpoint detection and response (EDR) solutions are active to identify and block suspicious process behaviors often associated with privilege escalation attempts.

Public Exploit Available: Yes, a public exploit exists via ExploitDB and multiple proof-of-concept repositories on GitHub.

Given the confirmed active exploitation and the critical nature of this kernel-level vulnerability, immediate patching is required. Organizations should prioritize deploying the necessary Microsoft updates to all affected Windows endpoints to prevent unauthorized privilege escalation and subsequent system takeover.