A use‑after‑free bug in the Desktop Window Manager causes an authorized local attacker to gain elevated privileges, allowing the attacker to execute code with higher privileges on the affected Windows system. The flaw is a CWE‑416 issue that can lead to arbitrary code execution and compromise of system integrity. The vulnerability enables the attacker to take complete control over the impacted machine, potentially allowing lateral movement, data exfiltration, or persistence.

The flaw affects multiple releases of Microsoft Windows, including Windows 10 version 21H2, Windows 10 version 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 22H3, as well as Windows Server 2022, Windows Server 2025, and the Server 23H2 core edition. Users running any of these operating systems are potentially impacted.

With a CVSS score of 7.8 the vulnerability is considered high severity. No EPSS score is available, and the flaw is not in CISA’s KEV catalog, suggesting that large‑scale exploitation is not currently documented. The attack vector is inferred to be local: an attacker must already be authenticated or have local execution privileges to trigger the use‑after‑free. Once executed, privilege escalation can be achieved without additional network exposure.