Local privilege escalation via unchecked kernel pointer

Heap-based buffer overflow in the Windows Kernel allows local users with low privileges to obtain SYSTEM-level access. ExpGetProcessInformation accepts an attacker-chosen kernel pointer for system information class 253 when the supplied length is zero, then increments counters through that unvalidated pointer while enumerating processes. Any unprivileged process, including a browser sandbox process, can reach the syscall; successful exploitation yields a kernel write primitive and local privilege escalation.