Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

What it is

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Why we say that

• Linked by CISA to known ransomware campaigns
• EPSS puts exploitation in the next 30 days at 60%
• 2 public exploits published
• CISA's federal remediation deadline (2024-03-25) has passed
• Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Indexed from Exploit-DB. Presence of code raises urgency; absence does not mean safety.

• Microsoft Windows 11 - Kernel Privilege Escalation local · windows · 2025-04-22
• Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation local · windows · 2024-04-02