A double free flaw in the Windows Projected File System permits an attacker who has local access to the affected system to execute arbitrary code with elevated privileges. By freeing a memory object twice, the kernel can be coerced into allocating attacker-controlled data in a critical system structure, allowing malicious code to run with kernel or system rights. The vulnerability is not remote; it requires an authorized user but can lead to full system compromise.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Windows Server 2019, Windows Server 2022, Windows Server 2025, and the 23H2 Server Core edition.

The CVSS base score of 7.8 reflects a high severity with local privilege escalation. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no widely known exploits yet. The attack vector is local, meaning an attacker must be able to run code on the machine, but once achieved, the impact is system-wide and permanent until remediated.