Microsoft Windows Search Component contains a use‑after‑free flaw that allows an authorized local user to execute code with elevated privileges. The vulnerability is a classic example of CWE‑416, enabling the attacker to gain higher levels of access, potentially culminating in full system control. The official description identifies it as an ‘Use after free’ that permits local privilege escalation but does not detail how the flaw is triggered, so the exact method is inferred rather than documented.

Affecting a range of Microsoft Windows operating systems: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server editions from 2012 through 2025, including the 23H2 edition. All configurations listed by Microsoft as vulnerable are impacted.

With a CVSS v3 score of 7.8, the flaw represents a high severity risk. No EPSS score is available, and the vulnerability is not included in CISA’s Known Exploited Vulnerabilities catalog, suggesting limited public exploitation. It is likely exploitable by an authorized user on the local system, with the attacker needing to trigger the use‑after‑free, perhaps via crafted search queries or files. Given the high impact and potential for local privilege escalation, the risk warrants immediate mitigation.