An authenticated local user can exploit a use‑after‑free condition in the Cluster Client Failover component on Microsoft Windows Server to execute code with higher privilege rights. The vulnerability stems from improper memory management (CWE-416) after a resource is freed, enabling the attacker to overwrite control data and consequently gain privileges beyond the original user context. This flaw permits the compromise of the system without requiring network or remote access, thereby enabling malicious actions such as installing software, modifying configurations, or accessing sensitive data.

Microsoft Windows Server 2016, 2019, 2022, the 2022‑23H2 edition, and 2025 (both standard and Server Core installations) are known to be affected. All listed Server editions contain the vulnerable Cluster Client Failover component.

The vulnerability receives a CVSS score of 7.8, indicating a high severity. The EPSS score is below 1%, reflecting a low probability of exploitation at this time, and the issue is not currently listed in the CISA KEV catalog. The attack vector is local; an authorized attacker who has legitimate access to the system can trigger the use‑after‑free, making the risk significant for environments that enable clustering on servers.