A use‑after‑free flaw in the Desktop Window Manager permits an attacker with local access to execute code with elevated privileges. The vulnerability is classified as CWE‑416 and can be leveraged to take control of the system or install and run additional software with administrative rights. If exploited, the attacker could compromise system confidentiality, integrity, and availability, potentially moving laterally within a network if elevated accounts are further abused.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3, 23H2, 24H2 and 25H2, Windows Server 2022, Windows Server 2022 (23H2 Edition – Server Core installation), Windows Server 2025 and Windows Server 2025 (Server Core installation).

The vulnerability has a CVSS score of 7.8, indicating a high severity level. The EPSS score is less than 1%, suggesting current exploitation activity is rare, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires local, authorized access and would proceed via the use‑after‑free condition in the Desktop Window Manager. Given its moderate‑to‑high severity and the potential for local attackers to gain full system control, organizations should consider this risk significant and patch early.