The flaw is a use‑after‑free (CWE‑416) vulnerability in the Microsoft Windows Search component that permits an unauthorized attacker to elevate privileges when interacting with the component over a network. The vulnerability allows the attacker to manipulate the memory management of the search service, potentially leading to unauthorized code execution or changes in executable privileges. The impact is a complete loss of integrity for the affected host, enabling the attacker to perform privileged actions as if they were a legitimate user.

Microsoft Windows products affected include Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server releases from 2012 R2 through 2025. Both x86, x64, and ARM64 architectures are impacted. The listed versions are those identified by the CNA vendor/product mapping.

The vulnerability has a CVSS score of 9.8, which classifies it as critical. No EPSS score is available, so the current exploitation probability is unknown but the lack of KEV listing does not mitigate the seriousness. The description indicates the attack vector is over a network, suggesting that a remote attacker with network access could trigger the use‑after‑free and obtain elevated privileges.