This vulnerability is a use‑after‑free flaw in the Windows Desktop Window Manager (DWM) core library. If an attacker can read a freed memory location, the system may be forced to execute code with the privileges of the user. The affected code path allows an authorized local user to gain higher privileges on the same machine, potentially giving them full control of the system. The weakness is identified as CWE‑416.

Microsoft Windows 11 26H1, 64‑bit editions, as specified by the CNA vendor/product list and detailed in the affected‑version data.

The CVSS score of 7.8 classifies the flaw as high severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the data provided. The flaw is not listed in the CISA KEV catalog. Based on the description it is inferred that the attacker must be a local user with the ability to trigger the use‑after‑free condition, and network‑based exploitation is unlikely.