The vulnerability is a use‑after‑free flaw in Windows Runtime that can be exploited by an authorized attacker to elevate privileges over a network. By freeing memory and then reusing it, the attacker can trigger a flaw that allows the execution of arbitrary code with higher-level privileges, thereby potentially compromising confidentiality, integrity, or availability.

Microsoft Windows 11 versions 24H2, 25H2, and 26H1 on arm64 and x64 architectures, as well as Windows Server 2025 (full and Server Core installations), are affected.

The CVSS score of 8.5 reflects high severity, but the EPSS score of less than 1% indicates a low probability of real-world exploitation. The vulnerability is not listed in CISA’s KEV catalog. The description specifies that the attacker must have authorized network access to the system in order to target the Windows Runtime process and perform the use‑after‑free attack. No information is provided about local exploitation, so it is unclear whether an attacker can elevate privileges from the same machine without network access.