The vulnerability is a double free bug in the Windows Win32K ICOMP component that can be triggered by an authorized attacker to elevate privileges locally. The flaw is classified as CWE‑415. Allowing a local user to gain elevated system‑level privileges can lead to full control over the affected device, bypassing normal security boundaries for local accounts.

Affected deployments include Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2, as well as Windows Server 2022 and the upcoming Windows Server 2025. The issue exists in both x64 and arm64 builds, impacting full and Server Core installations. Any system running these OS releases without the vendor update is vulnerable.

The CVSS v3.1 baseline score is 7.0, ranking it as high severity. The EPSS score of less than 1% indicates that exploitation is expected to be very rare, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker needs local user authorization to invoke the ICOMP routine. Once that condition is met, the double free can be leveraged to gain elevated privileges on the device.