The user can write 0 where he wants. This can be used to write SecurityDescriptor and write system processes. Therefore we can elevate privileges.
CVE Link
Exploit Type - Old
Exploits/Local
Exploit Platform
Product Name