A use‑after‑free flaw in the Windows Update Service permits an attacker with local, authorized access to gain higher privileges. The vulnerability can be exploited to execute code or perform actions as an elevated user, compromising the confidentiality, integrity, or availability of the affected system. It stems from a memory‑management weakness that allows the service to dereference freed objects, as identified in CWE‑416.

Affected versions include Microsoft Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Microsoft Windows Server 2025 (including Server Core installations). The vulnerability is present on both arm64 and x64 architectural builds of Windows 11 as well as on the server editions listed, as indicated by the supplied CPE identifiers.

The CVSS score is 7, indicating advanced privilege escalation potential. EPSS data is not available and the issue is not listed in the CISA KEV catalog, implying there are no confirmed widespread exploits. The likely attack vector is local, requiring the attacker to already have some level of authorized access to the target machine. While the flaw permits significant privilege gain, exploitation requires an attacker to be present on the system, which raises the bar compared to remote vectors.