The CVE describes a use‑after‑free condition in the Windows Software Protection Platform (SPP). When a vulnerable SPP component releases memory that is still in use, an attacker who can run code on the machine may manipulate the freed memory to trigger unexpected behavior that results in elevated privileges. This flaw can be leveraged by an authorized local user to gain higher privileges, potentially allowing them to compromise the entire system or execute arbitrary code with elevated rights. The weakness is classified as CWE‑416.

The vulnerability affects multiple Microsoft Windows releases. On Windows 10, any build from version 1607 through 22H2 is impacted, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. The issue also spans Windows Server editions, including Server 2016, 2019, 2022, and 2025 in both standard and Server Core installations. All affected systems run the Software Protection Platform component, which is responsible for licensing enforcement.

The flaw holds a medium severity score of 7.0 on the CVSS scale. No EPSS score is available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires local, authorized access and depends on triggering a use‑after‑free within SPP. Because the attack vector is local, it primarily threatens environments where a malicious or compromised user already exists on the machine. Adopting the latest Microsoft security updates that patch the use‑after‑free in SPP is the recommended approach to mitigate this risk.