This vulnerability is a use‑after‑free flaw in the Windows Local Security Authority Subsystem Service (LSASS). An attacker who can obtain an authorized session is able to craft a payload that causes LSASS to execute arbitrary code through the network. The resulting impact is the complete compromise of the system’s confidentiality, integrity, and availability, as the attacker can run commands with LSASS privileges. The weakness is characterized by CWE‑416, indicating a use‑after‑free condition.

Microsoft products affected are Windows 11 24H2 and 25H2, as well as Windows Server 2025 and its Server Core installation. The vulnerability applies to all builds of these versions that have not yet applied the Microsoft security update referenced in the official advisory.

The vulnerability carries a CVSS score of 7.5, indicating high severity, but the EPSS score is below 1%, suggesting that exploitation attempts are currently unlikely. It is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to obtain some authorized access to the target machine, after which the use‑after‑free flaw can be triggered over a network connection to execute arbitrary code with LSASS privileges. This remote code execution threat can compromise confidentiality, integrity, and availability of the system.