A local privilege escalation issue exists in the Windows Kernel due to a Time-of-Check to Time-of-Use (TOCTOU) race condition and a Use-After-Free flaw in the Windows Kernel Object Manager. The vulnerability is triggered by improper synchronization and reference counting of kernel object handles, specifically within the `NtQueryInformationToken()` function. An attacker can exploit this by triggering a race condition via repeated token handle operations or using an integer overflow that causes the kernel to allocate an undersized buffer, leading to an out-of-bounds write. This allows a local attacker to corrupt kernel memory, manipulate access tokens, and escalate privileges to NT AUTHORITYSYSTEM, bypassing User Account Control (UAC) and other security boundaries. This flaw has been exploited in the wild by the threat actor OilRig (APT34) in cyber espionage campaigns targeting infrastructure in the UAE and the Gulf region.