The vulnerability is a use-after-free flaw in the Windows Win32K ICOMP component that allows an attacker with local authorization to elevate their privileges. The flaw falls under CWE-416, indicating that a program improperly accesses memory after it has been freed. Once exploited, the attacker could gain higher privileges than originally intended, potentially allowing full system control and the installation of privileged software or unauthorized changes to system configuration.

Affected systems include Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Microsoft Windows Server 2025 in both full and Server Core installations. The CVE notes arm64 variants for Windows 11 24H2 and 25H2, and an x64 variant for Windows 11 26H1, indicating that the vulnerability spans multiple processor architectures.

The CVSS score of 7.8 places this flaw in the high severity range, but the EPSS score is not available, so the current exploitation likelihood cannot be quantified. It is not listed in the CISA KEV catalog, suggesting there is no widespread evidence of active exploitation yet. The attack vector is inferred to be local; an attacker must already have access to the target system and sufficient privileges to execute code that can trigger the use-after-free in ICOMP.