Use‑after‑free in the Windows kernel allows an attacker to send crafted network traffic that triggers the flaw, leading to arbitrary code execution and full control of the affected machine. This flaw is a use‑after‑free vulnerability (CWE‑416) and involves a heap‑based buffer overflow (CWE‑122). This flaw threatens confidentiality, integrity, and availability of the system, as the attacker can execute any code with kernel privileges.

The vulnerability affects Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including the Server Core edition). Both x64 and arm64 architectures are impacted, as reflected in the Microsoft update guide.

With a CVSS score of 9.8 this flaw is classified as critical, and its EPSS score of 15% indicates a relatively high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits are documented yet. Attackers would need to craft network packets that contain the precise payload to reach the vulnerable kernel entry point, making it a suitable target for remote exploitation.