Use after free in the Windows Speech runtime allows a code path that leads to local privilege escalation. The flaw arises when an authorized user interacts with the speech subsystem, causing a use‑after‑free and memory corruption that can be abused to execute arbitrary code with SYSTEM privileges. This is categorized as CWE‑416 and involves race conditions (CWE‑362). The result is that a local attacker can gain elevated privileges on the affected machine, enabling them to install software, modify system settings, or compromise confidential data.

The vulnerability touches Microsoft Windows 10 releases 1809, 21H2 and 22H2 as well as Windows 11 releases 23H2, 24H2, 25H2, 22H3 and 26H1. The affected architectures include x86, x86‑64 and ARM64 variants as listed in the CPE data.

The CVSS score of 7.8 indicates high severity, and while the EPSS score is not publicly available, the flaw requires a local user context to trigger. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed public exploit so far. Nonetheless, because an authorized local attacker can trigger the issue, the risk is significant if the system remains unpatched, especially in environments where privileged user accounts are available.