A use‑after‑free flaw in Windows Authentication Methods permits a local attacker who already has some level of access to obtain higher privileges on the system. By reusing a freed reference, the attacker can cause the operating system to execute code with elevated rights, potentially allowing full control over the machine. The flaw is classified as a use‑after‑free vulnerability (CWE‑416). This elevation can be used to bypass security controls, run malicious code, or tamper with system data.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025. All common processor architectures (x86, x64, ARM64) are impacted.

The CVSS score of 7.0 indicates moderate to high severity. EPSS at less than 1 % suggests that the likelihood of exploitation observed in the wild is low at present. The vulnerability is not listed in the CISA KEV catalog. Attack is local, requiring an authenticated user or a user interacting with the affected system. Once compromised, an attacker can gain unrestricted control over the machine and its resources.