Use after free in the DirectX graphics kernel allows an authorized local attacker to gain elevated privileges. The flaw is a classic use‑after‑free (CWE‑416) arising from a data‑race condition (CWE‑362) that can cause kernel components to access memory that has already been freed. Successful exploitation could enable the attacker to execute arbitrary code with system‑level privileges, potentially compromising the entire host.

The vulnerability is present in Microsoft Windows 10 starting with version 1607 through 22H2, Windows 11 from 22H3 through 25H2, and a variety of Windows Server releases including 2016, 2019, 2022, 2025 and their Server Core variants. These editions ship with the same kernel‑mode DirectX driver that contains the defect.

The CVSS base score of 7 indicates a moderate‑to‑high risk. An EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an authorized local attacker with the ability to run DirectX code, the attack vector is local. If the vulnerability is successfully exploited, the attacker could elevate privileges to that of the operating‑system user, potentially allowing full control over the affected machine.