A use-after-free flaw in the Microsoft QUIC implementation can be triggered by an unauthorized attacker to execute arbitrary code. The vulnerability arises when a freed memory region is accessed again, allowing the attacker to control program flow once a connection is established. This leads to complete compromise of the affected system, as any loaded code can run with the privileges of the QUIC process.

Affected by the CVE are Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including the Server Core installation). The affected sub‑architectures include both x86_64 and arm64 platforms, covering desktop and server-class machines.

The CVSS score is 9.8, indicating a critical severity. EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, which means it has not yet been observed in the wild or is not documented as a known exploited vulnerability. The attack vector is inferred to be network-based through QUIC traffic, as the flaw is triggered during remote QUIC connections.