A use‑after‑free flaw in Windows Update Delivery Optimization allows an attacker who already has local access to elevate privileges. The vulnerability enables a standard or slightly privileged user to trigger an uninitialized memory dereference, leading to arbitrary code execution under the high‑privilege context of system services. Based on the description, it is inferred that the flaw involves a misuse of memory management within the update delivery component, which can be exploited to run code as an elevated user.

Operating systems affected include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2019 (full and core), Windows Server 2022, and Windows Server 2025 (full and core).

The CVSS score of 7.0 indicates a high‑severity local privilege escalation. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, there is no evidence of widespread exploitation yet. Nonetheless, an attacker with local system access could potentially trigger the flaw by manipulating the Windows Update Delivery Optimization service or delivering a crafted update payload, as inferred from the described behavior. This could grant full system control, making the vulnerability a critical risk for compromised workstations and servers.