Dozens of bugs in a core Windows API could enable attackers to elevate their privileges in the operating system.