A use‑after‑free flaw in the Windows kernel permits an authorized local attacker to elevate privileges to that of the Windows NT kernel, effectively achieving SYSTEM or administrator rights. This is classified as a CWE‑416 vulnerability and could allow the attacker to execute arbitrary code with full system privileges, potentially compromising data confidentiality, integrity, and availability. The description specifies only local elevation without mention of remote exploitation.

Microsoft Windows products including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1, and the corresponding Windows Server releases from Server 2012 through Server 2025, all CPU architectures covered by the provided CPE list are affected.

The CVSS score of 7.8 indicates high severity, but the EPSS score is below 1%, illustrating a very low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, reinforcing its limited exploit likelihood. Based on the explicit description of local privilege escalation, the likely attack vector is a local user with authorized access, possibly abusing application memory management. No remote attack scenario is indicated in the available data.