Use‑after‑free in Windows User Interface Core enables an authorized local attacker to elevate privileges. The flaw is a race condition combined with a memory use‑after‑free, allowing a malicious user to obtain higher rights on the system, potentially compromising confidentiality, integrity, and availability if the elevated privileges are abused.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2019; Microsoft Windows Server 2022; Microsoft Windows Server 2025; Microsoft Windows Server 23H2 edition, including Server Core installations.

The CVSS score of 7.8 indicates a high severity level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local authorized access to the target machine, most likely involving manipulation of UI elements that trigger the use‑after‑free. No remote exploitation vector is documented.