The vulnerability is a double free flaw in the Windows Kerberos authentication component. When exploited, it allows an attacker who already has local access to the system to gain elevated privileges. The flaw does not enable direct remote code execution or network-based exploitation; it strictly enhances the privileges of a local attacker.

Affected are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 version 23H2 (both arm64 and x64); Windows Server 2016 (full and Server Core), Windows Server 2019 (full and Server Core), Windows Server 2022, and Windows Server 2025 (full and Server Core). All listed versions are vulnerable to the double free in Kerberos.

The CVSS score of 7 indicates a high-vector vulnerability, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires local authorization, the risk is confined to systems with compromised or user‑authenticated processes. The exploit path requires triggering the double free during a Kerberos transaction, which may be difficult but is feasible for an attacker with local access. Overall, the risk warrants prompt remediation, but it is not a globally active remote threat.