This is a big issue in enterprise deployments. Consider, for example, the Sony hack - this is the kind of issue that allows a savvy low-level employee to wreak havoc on their employer, because once you can get root on a machine inside a corporate network, all kinds of doors open.

This isn't a remote root code execution bug, but it shouldn't be taken lightly, either. The exact environments where this bug would be applicable (locked-down) are the environments that could suffer severe damage because of an escalation issue.

The thing is, though, local privilege escalation isn't new, and it isn't novel. This is one in a long string of many, many similar bugs across most every major platform. It's completely unremarkable except for the reluctance on MS's part to patch it in a reasonable timeframe.

A not-particularly informed take:

It means that every user effectively has root privileges. Which means that every user can eavesdrop on other users, view their saved data and files (unless encrypted on disk), intercept their network communications, impersonate them, steal their passwords (system, application, external web sites).

How bad that is depends on your particular use case. But for pretty much any setup where security is a concern or there's any sensitive data at stake, this is a very serious issue.

However, in the case of Windows, this issue isn't that much severe as it would be on a unix-like, for example.

With the set up of Windows servers I've seen, only the admin logs in anyway. It's not really used as a "multi-user" system per-se, where you get different users logging in at the same time. It does happen, but it's not common.

Hahah, I figured Windows might be slightly better about this, hence the self-admitted uninformed take.

Could you clarify, though: do you mean to say Windows isn't as vulnerable because of cultural reasons (i.e. Windows systems aren't multi-user usually) or because of technical ones (they support something like SELinux out of the box)?

The impact isn't as severe, for cultural reasons.

This is pretty much how I was interpreting it. For context I did an internship at a bank, I had access to a computer and login credentials, but not admin access. I get the feeling that this would be a hair on fire problem there if like you said it'd mean me effectively having root.

You can combine such a privilege escalation with an USB virus, social engineering, etc. to get remote root access to a machine and eventually all machines of a network.