The vulnerability is a use‑after‑free flaw in the Windows Clipboard Server, classified as a race condition (CWE‑362) and a use‑after‑free (CWE‑416). Exploitation permits an unauthenticated local user to gain elevated privileges on the affected system. The flaw resides in the clipboard service’s handling of memory, allowing malicious code to be executed with higher privileges when a specific sequence of memory allocation and deallocation occurs. The impact is that an attacker who is able to run arbitrary code locally can elevate their access level to system or administrator, potentially enabling further compromise of the machine.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 22H3; and Microsoft Windows Server releases 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS v3.1 score of 7.4 indicates a high severity local privilege escalation, while an EPSS rating of less than 1 % suggests that exploitation attempts are currently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no publicly documented exploit is known. Attackers would need to execute code on the target machine, making the attack vector local. However, once local access is achieved, the flaw can be leveraged to raise privileges, bypassing security controls that rely on user privilege separation.