A use‑after‑free bug in Windows Runtime enables an authorized local user to run code with higher privileges. The flaw occurs when the operating system accesses memory after it has been freed, allowing the attacker to inject and execute arbitrary code that inherits the higher privilege level of the privileged component. This elevation occurs locally within the user’s environment and does not grant remote access.

The vulnerability applies to several Microsoft Windows releases including Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including Server Core installations. Affected architectures span x86, x64, and arm64.

The CVSS score of 7 indicates a high severity for local privilege escalation, but the EPSS score of less than 1% reflects a very low likelihood of exploitation at this time. The issue is not listed in CISA’s KEV catalog, suggesting no documented widespread attacks. Exploitation requires an authorized local user, making the attack vector local rather than remote.