Windows Vista winsat.exe Integer Overflow

There is a flaw in windows vista benchmarking tool, called winsat.exe, th=
at runs withs administrative privileges.=0D
=0D
The problem, is an integer overflow in -totalobj argument, example:=0D
=0D
winsat d3d -texshader -totalobj 2147483648=0D
=0D
this result in a overflow of the signed int that stores the totalobj argu=
ment, and turns it negative, and then, the program crashes.=0D
=0D
I'm not sure if you can control some memory using other options in winsat=
.exe arguments to take advantage of this issue, and exploit it.=0D
=0D
Even if the bug is exploitable, the User Access control present in vista,=
 shows a message asking for privileges before execute it, the only advant=
age of this issue, I think that is the message asking for privileges, sho=
ws information about the process, and this is the information that the us=
er have in mind to decide if accept or not, and if you execute a windows =
util, it asks for privileges, the information about WHO is asking for pri=
vileges, is a trusted windows util (winsat.exe, in system32) and then, if=
 you can control the process, you can use this kind of bugs as way to tri=
ck the user to bypass the UAC and get admin.=0D