This vulnerability is a use‑after‑free flaw in the Windows Win32K kernel component’s ICOMP interface, categorized as CWE‑416. A malicious actor who already has local access can craft an operation that frees memory and subsequently reuses it, allowing the execution of arbitrary code with kernel‑level privileges. The improper handling of freed memory permits the attacker to bypass normal privilege boundaries and elevate their permissions to system‑level access.

Affected vendors and products are Microsoft Windows 11 versions 23H2 and 22H3, as well as Microsoft Windows Server 2022, including the 23H2 Server Core edition. All systems running the Win32K component within these revisions are potentially vulnerable.

The CVSS score for this issue is 7.8, reflecting a high severity, while the EPSS score is below 1%, indicating a low current exploit probability. The vulnerability is not listed in the CISA KEV catalog. Attackers require local presence and the ability to invoke the ICOMP interface; no remote execution vector is documented. When triggered, the use‑after‑free can allow kernel‑level code execution, leading to full system compromise.