A use‑after‑free flaw in certain Windows kernel‑mode drivers allows an authorized user to execute code after memory has already been freed. This can grant the attacker higher privileges on the system. The weakness is identified as CWE‑416 and directly undermines operating‑system integrity.

Microsoft Windows 11 24H2, 25H2, and 26H1 and Windows Server 2025, including Server Core, are affected; the 24H2 and 25H2 builds are vulnerable on arm64, while the 26H1 build is affected on x64.

The CVSS base score of 7 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local: a user or process with sufficient privileges to interact with the faulty driver can trigger the flaw. Based on the description, it is inferred that no public exploit has been observed.