The flaw is a use‑after‑free in the Windows Common Log File System driver. An attacker who has local user authority can force a released object to be reused, creating an execution path that runs arbitrary code with SYSTEM privileges. This directly compromises the confidentiality, integrity, and availability of the affected host by allowing the attacker to modify system files, install malware, or take full control of the operating system.

Affected installations include Microsoft Windows 10 releases from version 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 editions 23H2, 24H2, 25H2, 22H3, and 26H1. The vulnerability also impacts Windows Server 2012 through Server 2025, including all common installations and core variants.

The CVSS score of 7.0 indicates a medium‑to‑high severity. No EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation has not yet been observed. The likely attack vector is local: an authenticated user must trigger the use‑after‑free within the Common Log File System driver to gain SYSTEM privileges.