The vulnerability is a use‑after‑free defect in the Microsoft Windows Network Connections Service that permits an attacker with local authorization to gain elevated privileges. By freeing memory and then acting upon it, the attacker can execute arbitrary local code with higher rights, thereby compromising system integrity and confidentiality.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server releases from 2012 through 2025, both standard and Server Core installations.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of 2% reflects a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers require local privileges to trigger the use‑after‑free; after exploitation, the privilege escalation can be used for further system compromise.