The vulnerability is a use‑after‑free condition in the Windows Management Services that permits an attacker with local authorization to gain elevated, local privileges. Because the fault occurs after a resource has been freed, an attacker could craft input that causes the service to execute code under a higher privilege context. The issue is classified under CWE‑416 (Use After Free) and CWE‑362 (Race Condition).

Microsoft Windows 10 version 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Microsoft Windows Server 2019, 2022, and 2025, including Server Core installations for 2019, 2022, and 2025.

This flaw carries a CVSS score of 7.8, indicating a high severity risk. The EPSS score is below 1%, suggesting a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local; an adversary must first authenticate on the affected system and then exploit the Windows Management Services. The use‑after‑free can grant arbitrary code execution at local level, enabling unrestricted control over the machine.