An issue exists in the way the Windows Client/Server Run-time Subsystem (CSRSS) terminates a process when a user logs off, allowing local users to obtain sensitive information or gain privileges via a crafted application. This could enable an attacker to monitor the actions of a subsequent user, potentially disclosing sensitive information or accessing data that was accessible to the logged-on user, including logon credentials. If a user with administrative privileges logs on, the attacker could run arbitrary code in kernel mode.