The vulnerability is a use‑after‑free flaw in the Windows Projected File System that allows an attacker with local access to the system to gain elevated privileges. When successfully exploited, the attacker can execute code with higher rights, potentially taking full control of the machine or accessing sensitive information.

Affected Microsoft products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; as well as Windows Server 2019, Server 2022, Server 2025, and Server 23H2 (including Server Core installations). Users running any of these operating systems are at risk.

The CVSS score of 7.8 signals high severity, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is local; an authorized user must trigger a use‑after‑free condition within the projected file system. EPSS data is unavailable, but the nature of the flaw means that a system‑level impact can be achieved once bypassed. Patching removes the flaw and eliminates the risk of privilege escalation.