That thread still has higher privilege write access to it's process's state, including the stacks of other threads that haven't impersonated that client. Imper

That thread still has higher privilege write access to it's process's state, including the stacks of other threads that haven't impersonated that client. ImpersonateNamedPipeClient is a very leaky security barrier, and far from the only thing you need to know about when it comes to named pipe security.