Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CWE-122, CWE-415