Priviledge escalation from a non admistrative user, best way I could describe it is type confusion, writing values in a kernelmode structure with an api that was not designed for it. For example instead of writing window data, you write priviledge data.