Technical impact
The vulnerability is a use‑after‑free flaw in Microsoft Windows Security App that lets an authorized local attacker gain higher privileges. The flaw is classified as CWE‑416, meaning a dangling pointer is accessed after the memory has been freed, allowing the attacker to execute arbitrary code with elevated rights.
Affected Systems
Microsoft Windows Security App is affected. Specific versions that contain the flaw are not disclosed in the available data, so all installations of the app should be treated as potentially vulnerable.
Risk and Exploitability
With a CVSS score of 7, this flaw poses a high severity risk. Exploitation requires local access and an authorized user context, but the attacker can elevate privileges to an administrative level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog at this time. The likely attack vector is a local authenticated user exploiting the app, suggesting that any machine with the vulnerable component is at risk if an authenticated user attempts to trigger the use‑after‑free condition.
