A use‑after‑free flaw in Windows Management Services allows an authorized local attacker to gain elevated privileges. The vulnerability is triggered during normal service execution, potentially allowing the attacker to execute code with higher integrity levels, and based on the description, it is inferred that this could compromise confidentiality, integrity, and availability of the affected system. The flaw manifests as a race condition and an erroneous memory reference, identified by CWE‑362 and CWE‑416.

Affected products include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and Microsoft Windows Server 2019, Windows Server 2022 (including 23H2 Edition and Server Core installations), and Windows Server 2025 (including Server Core installations). Windows versions are available in both 32‑bit and 64‑bit architectures as appropriate.

The vulnerability carries a CVSS score of 7.8, indicating moderate to high severity. EPSS reports a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires local access to the device and an authenticated user that can interact with Windows Management Services. While the exploitation likelihood is low, any local user can exploit the flaw, making the risk significant for environments with many privileged accounts or exposed services.