A use‑after‑free flaw in the Desktop Window Manager module permits a local user who can run a malicious program to gain higher privileges. Because the bug corrupts memory after a free operation, an attacker can trigger privileged code execution, allowing them to act with administrative rights on the compromised machine. The vulnerability’s nature—an unchecked memory reference—aligns with the CWE‑416 Use After Free weakness.

The defect affects Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2, Windows 11 releases 23H2, 24H2, 25H2, 22H3, 26H1, and a range of Windows Server editions from 2016 through 2025, including Server Core configurations. All affected editions are listed in the vendor advisory, and any workstation or server running these builds is potentially vulnerable if not updated.

The CVSS score of 7.8 indicates a high‑severity local privilege escalation, while the EPSS value is currently not available, so the exact likelihood of exploitation is unclear. The vulnerability was not catalogued in the CISA KEV list, but given the local nature and use‑after‑free mechanism, an attacker who can execute code at a low privilege can elevate to full system control. Mitigating factors include the requirement for an authenticated local user and the absence of a known public exploit at release time.