A use‑after‑free flaw in the Windows kernel allows an attacker who already has local access to cause the kernel to execute code with elevated privileges. The description indicates that the attacker must already be authorized locally; thus it is inferred that no remote exploitation path is available. The vulnerability is a classic memory corruption bug (CWE‑416), enabling an authorised user to gain higher privileges without needing to cross the network boundary or exploit a remote service. The impact is that any authenticated local attacker can execute arbitrary code with kernel privileges, potentially compromising the entire system.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 24H2, 25H2, 26H1; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The vulnerability is rated high with a CVSS score of 8.8. The EPSS score of 2% indicates a low to moderate probability of exploitation today, and it is not yet listed in CISA’s KEV catalog. An authorised local attacker would need access to the affected machine to craft the payload that triggers the use‑after‑free. Once triggered, kernel‑level code execution can be achieved, granting full control over the system.