Local privilege escalation via unchecked token handle

Incorrect authorization in Microsoft Windows Container Manager Service allows local users to elevate privileges through a crafted RPC call. CmsRpcSrv_CreateContainer accepts a caller-supplied token handle without verifying that the caller may impersonate it, then starts cmproxyd.exe under that identity. Exploitation requires local low-privileged access and a handle to a more privileged token; the resulting process remains confined to an AppContainer.