A use‑after‑free flaw in the Windows Server Update Service allows an attacker who already has authorized access to the service to elevate that attacker’s privileges on the local machine. The vulnerability is identified as CWE‑416, indicating a memory corruption error that can be triggered to execute code with higher privileges than originally granted.

Microsoft Windows 11, 26H1 edition, when the Windows Server Update Service component is installed and enabled. Any user with legitimate access to the WSUS service on this build is potentially able to exploit the flaw.

The CVSS score of seven reflects a high severity local privilege escalation. Exploitation requires that the attacker first obtain an authorized user context or a valid account that can interact with the WSUS service. Because the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the probability of widespread exploitation is uncertain, yet the impact for affected systems remains significant if attackers gain elevated rights.