A use‑after‑free flaw exists in the Windows WAN ARP driver. When a privileged process deallocates a buffer, an attacker can trigger subsequent operations on that freed memory, allowing kernel‑level code execution. This vulnerability can be leveraged to gain elevated privileges locally, permitting the attacker to bypass security boundaries, install malware, or alter system configurations.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1, Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. All listed architectures are affected as stated in the CPE references.

The CVSS score of 7.8 reflects a high severity, yet the EPSS score is not available, so current exploitation likelihood remains uncertain. The vulnerability requires local authorized access and exploits a kernel‑mode driver memory error, making the attack vector internal. It is not listed in the CISA KEV catalog and no public exploit has been seen, indicating a moderate but potentially elevated risk if the operating system remains unpatched.