A use‑after‑free bug in the Windows Server Data Deduplication component allows an authorized local user to execute privileged operations. The vulnerability is a classic instance of CWE‑416, where memory that has already been freed is accessed again, enabling the attacker to gain higher privileges than they currently possess.

Microsoft Windows Server operating systems from 2012 R2 up to the 2025 release, including both full installations and Server Core variants, are affected.

The CVSS base score of 7.8 indicates a high‑risk local privilege escalation with no remote attack vector noted. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while the flaw is serious, it has not yet been broadly exploited in the wild. An attacker must be authenticated on the target system, likely with low‑level privileges, and must leverage the Data Deduplication module to trigger the use‑after‑free condition.