A use‑after‑free flaw in the Windows kernel enables an attacker who has local system access to trigger a memory corruption that results in privileged escalation. The vulnerability allows the compromised code path to execute with kernel privileges, potentially enabling full control of the affected system. It is classified as CWE‑416, a classic use‑after‑free weakness, and does not expose remote interfaces directly, but it can be triggered by locally privileged or even user‑level processes that can follow the exploitation chain.

Affected products include Microsoft Windows 10 releases 1809, 21H2, and 22H2, Windows 11 releases 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2019, Windows Server 2022, and Windows Server 2025, both in full and Server Core installations.

The CVSS score of 7 indicates a moderate severity for the risk posed to systems that are not patched. EPSS is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, but the nature of the flaw—requiring local execution and an authorized attacker—means that a malicious user or process with sufficient privileges to write memory could exploit it. The attack vector is inferred to be local, stemming from the use‑after‑free condition in kernel memory management.