Two vulnerabilities have been discovered in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges.

1) An error in win32k.sys when processing certain parameters associated with a keyboard layout file can be exploited to corrupt memory.

2) An error in win32k.sys when creating hook procedures can be exploited to dereference a handle as if it was a pointer.

Successful exploitation of the vulnerabilities allows execution of arbitrary code with kernel-mode privileges.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Nicolas Economou, Core Security Technologies and Dmitry Oleksiuk (cr4sh0). The vendor also credits Qihoo 360 Security Center.
2) Lufeng Li, Neusoft Corporation via Secunia

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS12-047 (KB2718523):
http://technet.microsoft.com/en-us/security/bulletin/ms12-047

Dmitry Oleksiuk (cr4sh0):
http://blog.cr4.sh/2012/05/post-ms12-034-0day.html

Core Security Technologies:
http://www.coresecurity.com/content/windows-kernel-readlayoutfile

Deep Links
Links available to Secunia VIM customers