Use after free in the Connected Devices Platform Service (Cdpsvc) can be triggered by an authorized local user to elevate privileges. Triggering a wrong‑pointer access to freed memory may allow the attacker to execute code at elevated system level, bypassing normal security boundaries. The flaw enables an attacker to gain administrator‑level access, potentially compromising system integrity and confidentiality.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server editions 2019, 2022, 2025, along with their Server Core installations. The vulnerability spans both x86 and x64 architectures and, for some Windows 10 releases, ARM64.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1 percent suggests a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog, implying no publicly documented exploitation to date. An attacker must have an authorized local account to initiate the use‑after‑free; exploitation would typically involve interacting with Cdpsvc through legitimate system pathways, potentially requiring additional user actions. Given the local nature of the attack vector, the threat is limited to machines that have not applied the Microsoft patch, but the impact is significant if successful.