The flaw is a use‑after‑free condition in the Windows Software Development Kit that allows an attacker with local authorization to gain elevated privileges on the affected system. The vulnerability arises when the SDK interacts with memory after it has been freed, resulting in the possibility of arbitrary code execution with higher privileges. This can compromise the confidentiality, integrity, or availability of the system if exploited by a malicious user on the same host.

Affected operating systems include multiple releases of Windows 10 (v1809, v21H2, v22H2), several Windows 11 releases (v23H2, v24H2, v25H2, v26H1, v23H2, v26H1), and Windows Server editions such as Server 2019, Server 2022, and Server 2025 in both standard and Server Core installations. These versions are listed in the advisory with associated CPEs, and any machines running the included SDK components are at risk.

The CVSS score of 7.8 classifies the vulnerability as High severity, although no EPSS score is provided and it is not currently listed in the CISA KEV catalog. Based on the description, the attacker must have local access or authorization to trigger the use‑after‑free, making it a local privilege escalation scenario. The attack vector is inferred to be local rather than remote, and successful exploitation would enable an attacker to execute privileged code, potentially taking full control of the compromised machine.