A use-after-free defect in the Desktop Window Manager (DWM) core library allows an authorized local user to gain system‑level privileges. The vulnerability is a classic memory corruption flaw (CWE‑416) that can be triggered by malicious input to DWM, enabling the attacker to execute arbitrary code with elevated rights. Consequently, the attacker can access protected resources, modify system configuration, or install additional malware without further authorization.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, Windows Server 2022 (including the 23H2 Server Core edition), and Windows Server 2025 (including Server Core installation).

The CVSS score of 7 indicates moderate to high severity, while the EPSS score of less than 1% reflects a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an authorized attacker who can run code on the target machine. Exploitation would involve triggering the DWM use‑after‑free bug to obtain privileged execution.