The vulnerability is a double free bug in the Windows kernel that permits an authorized attacker with local access to corrupt memory and achieve higher privileges. This can allow the attacker to gain SYSTEM level access, compromising the confidentiality, integrity, and availability of the affected system. The weakness is categorized as a CWE‑415: Double Free.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 22H3, and 26H1; and several Server editions such as Windows Server 2012 R2, 2016, 2019, 2022, 2025, and 23H2.

The assigned CVSS score of 7.8 indicates a high severity potential for local privilege escalation. The EPSS score is not available, but the lack of inclusion in the KEV catalog suggests no widely known public exploitation yet. The likely attack vector requires an authenticated local user, implying the risk is greatest in environments where users possess administrative or elevated privileges. Prompt application of the vendor patch is recommended to mitigate the risk.