Double free bug allows an authorized local attacker to gain elevated code execution, potentially compromising system integrity and confidentiality. This flaw exists in the Windows kernel and is classified as CWE‑415. By exploiting the free vulnerability, an attacker can bypass security boundaries and run arbitrary code with kernel privileges, enabling full system takeover.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1 across both ARM64 and x64 architectures, as well as Windows Server 2022 (23H2 Edition Server Core), Windows Server 2025 and the Server Core installation of the 2025 release are all affected.

The CVSS score of 7.8 indicates high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting moderate risk of widespread exploitation yet still significant due to local attacker capability. The likely attack vector is a local authorized user triggering the double free, which can lead to privilege escalation if the user has sufficient rights to influence kernel memory management.