Use‑after‑free in the Windows kernel permits an attacker to execute arbitrary code over a network. The flaw provides an attacker with the ability to take full control of the affected machine, creating a severe risk to confidentiality, integrity, and availability.

Affected products include Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1 as well as Windows Server 2022 and Windows Server 2025 (Server Core). The vulnerability spans both x64 and arm64 architectures as documented in the update guide.

The CVSS score of 9.8 marks this flaw as critical. EPSS is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit yet. Attackers would need to send crafted network traffic to reach the vulnerable kernel entry point, making the vulnerability an attractive target for remote exploitation.