The vulnerability is a use‑after‑free flaw in the HID class driver that permits an attacker with physical access to a human‑interface device to gain elevated privileges on the host system. The flaw occurs when the driver mistakenly reuses freed memory leading to improper control over object lifetimes. An attacker can exploit this to execute arbitrary code at elevated privilege levels, effectively bypassing OS security controls. This vulnerability is associated with CWE‑416.

Affected systems include Microsoft Windows 10 releases from version 1607 through 22H2 and Windows 11 releases 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1, as well as Windows Server editions from 2012 R2 up through 2025. The flaw affects both x86 and x64 architectures in Windows 10 and the ARM64 profile in certain Windows 11 releases.

The CVSS score is 6.4, indicating a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation at this time. However, because the attack requires physical access to a HID device, the exploitation likelihood may be limited to environments where an attacker can tamper with peripheral hardware. The vulnerability is local in scope and requires no network‑based attack vector.