A use‑after‑free flaw in the Desktop Window Manager (DWM) Core Library lets a local attacker who can execute code on the machine gain SYSTEM‑level privileges. When an object is freed and later accessed, the attacker can run arbitrary code with elevated rights. The weakness is identified as CWE‑416.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2019 (full and Server Core), 2022, and 2025 (full and Server Core). These operating systems include the DWM component that contains the faulty logic.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a local user who can trigger DWM, so the attack vector is local. An attacker with such access can execute code as SYSTEM through the use‑after‑free. Although no public exploits are known, the high CVSS and local privilege escalation potential make patching a priority.