Use after free flaw in Microsoft Windows 11 Autopilot allows an attacker who already has authorized user rights to raise their privileges locally to higher levels, potentially gaining full control over the device.

Microsoft Windows 11 versions 24H2, 25H2, and 26H2 for ARM64-based systems are affected by this flaw.

The vulnerability has a CVSS score of 7.0, indicating high severity. Because the flaw is local and only requires that the attacker have some level of legitimate user access, the attack surface is limited to devices where Autopilot is in use. No EPSS score is provided, so the exploitation probability cannot be quantified; the vulnerability is not listed in CISA's KEV catalog, suggesting no public evidence of widespread exploitation yet.