An incorrectly released pointer in Windows Modern Device Management (MDM) enables an attacker who already has authorized access to elevate their privileges on the same system. The flaw allows the attacker to gain higher local rights, potentially enabling full system control. The weakness is classified as CWE‑763, representing an improper handling of resources.

Microsoft Windows Server 2022 is the affected vendor product. The CVE statement identifies this operating system version as the only vulnerable platform, and no additional affected versions are listed in the available data.

The CVSS score of 7.8 rates this vulnerability as high severity, indicating significant impact if exploited. EPSS data is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting that there is no widespread exploitation evidence yet. The likely attack vector is local, as the attacker must be authorized to use MDM. With successful exploitation, the attacker can elevate privileges to administrator or higher, compromising confidentiality, integrity, and availability of the server.