This vulnerability is a use‑after‑free flaw in the Windows SMB client that permits an attacker who already has authorized local access to a device to elevate their privileges on that device. The flaw arises from improper memory handling during SMB operations, which an attacker can exploit to gain higher rights. The weakness is classified as CWE‑416.

The affected products are Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 22H3, 26H1), Windows Server 2012 R2, and Windows Server 2016, 2019, 2022, 2025, 23H2. Both client and server core installations are impacted.

The CVSS score of 7 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting it is not currently known to be exploited in the wild. The attack vector is local; an attacker must already have some authenticated access to the target machine to trigger the use‑after‑free. Upon success, the attacker can elevate privileges, potentially enabling malicious modification or execution of data.