Technical impact
The vulnerability is a use‑after‑free condition in the ICOMP component of the Windows Win32K subsystem, allowing an authorized local attacker to elevate privileges. The flaw falls under CWE‑416, indicating that a program improperly accesses memory after it has been freed. Once exploited, the attacker could gain higher privileges than originally intended.
Affected Systems
Affected systems include Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Microsoft Windows Server 2025 in both full and Server Core installations. The CVE notes arm64 variants for Windows 11 24H2 and 25H2, and an x64 variant for Windows 11 26H1, indicating that the vulnerability spans multiple processor architectures.
Risk and Exploitability
The CVSS score of 7.8 places this flaw in the high severity range. The EPSS score of 2% indicates a low probability of exploitation, yet the high severity means the vulnerability remains significant. It is not listed in the CISA KEV catalog, suggesting there is no widespread evidence of active exploitation yet. The attack vector is inferred to be local; an attacker must already have access to the target system and sufficient privileges to execute code that can trigger the use‑after‑free in the ICOMP component of Win32K.
