The vulnerability is a use‑after‑free flaw in the Win32 kernel subsystem. When triggered by an authorized user, it allows local code to manipulate memory after it has been freed, potentially enabling the attacker to elevate their privileges to system level. This deficiency is identified as CWE‑416 and results in a local privilege escalation that threatens confidentiality, integrity, and availability on the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 version 23H2 (ARM64 and x64); Microsoft Windows Server 2012, 2012 R2, 2016, 2019, and 2022 (including Server Core installations) are affected. All listed operating system releases contain the vulnerable Win32 kernel subsystem.

The CVSS score of 7.0 indicates a medium severity. Because it is not listed in the CISA KEV catalog and EPSS is unavailable, there is no documented exploitation activity, but local users with sufficient privileges could exploit it by using the vulnerable subsystem to execute arbitrary code with elevated rights. Attackers must have local access; the exploit is not remote. The lack of official KEV listing suggests limited public exploitation, but the medium CVSS and use‑after‑free nature warrant immediate attention.