The vulnerability is a use‑after‑free condition in Windows Management Services. An attacker who already has access to the service can trigger the flaw and obtain elevated privileges on the local machine. The flaw is categorized as CWE‑416, exposing a memory‑management error that allows higher‑privilege execution. The effect is that a legitimate local user could gain administrative rights without additional attack steps.

The flaw affects Microsoft Windows 10 releases 1809, 21H2, and 22H2; Windows 11 releases 22H3, 23H2, 24H2, and 25H2; and Windows Server releases 2019, 2022, 2025, including Server Core installations. These versions are identified by the Microsoft CPE entries in the advisory.

The CVSS score of 7.8 marks it as high‑severity. The EPSS score of less than 1% suggests that exploit attempts are unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw requires only local access to the managed service, it poses a considerable risk in environments where users can run the Windows Management Services or where administrative accounts are accessible from local sessions. Attackers would need to execute privileged code after successfully freeing memory within the service, which can be achieved by sending a specially crafted request to the service.