A use-after-free flaw in Windows Management Services causes an authorized local attacker to gain elevated privileges on a system. The vulnerability allows the attacker to execute code or perform privileged actions that normally require administrative rights. It is a classic example of CWE-416, where memory that has already been freed is accessed again, leading to undefined behavior and privilege escalation.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Windows Server 2019; Windows Server 2022; and Windows Server 2025, including Server Core installations of the listed Server editions.

The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not cataloged in CISA’s KEV list, further suggesting limited active targeting. The attack vector is inferred to be local, requiring an authenticated user with some level of local account privileges to craft the malicious input that triggers the use-after-free and raise privileges. Given these conditions, the risk is moderate, and the exploitation complexity appears low for an attacker who already has local access.