An authorized user can exploit a use‑after‑free bug in the Desktop Window Manager component to elevate their privileges on the local system. The flaw allows the attacker to access memory that has already been released, resulting in code execution with higher rights. This can lead to full control over the affected machine, enabling the installation of malware, changing system configurations, or exfiltrating data.

This vulnerability affects Microsoft Windows 11 builds 23H2, 24H2, 25H2, 26H1, and 22H3, as well as Windows Server 2022 and Windows Server 2025, including all Server Core installations of these editions.

The CVSS score of 7.8 indicates a high severity, combined with a lack of publicly disclosed exploit code. The flaw requires local, authorized access, so the attack vector is likely local attacker or process. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Nevertheless, the ability to gain elevated privileges makes it a critical risk for all affected systems.