Technical impact
An authorized local user can exploit a use‑after‑free bug in a Windows WebView component to execute arbitrary code with higher privileges. The flaw occurs when the component improperly frees memory used for rendering, allowing a malicious payload to be injected into the freed region. Successful exploitation can elevate a standard user to an administrator or system level, compromising confidentiality, integrity, and availability of the affected machine.
Affected Systems
Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including Server Core installations. These are the only editions reported to contain the vulnerable WebView implementation. All other Windows releases are not known to be affected.
Risk and Exploitability
The CVSS score of 7.0 categorizes this vulnerability as High, reflecting the severity of a successful privilege escalation. The EPSS score of less than 1% indicates that exploitation cases are expected to be rare at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploits have been confirmed. Because the attack requires a user with local authorized access to send crafted content to WebView, the vector is local. Environments that have privileged local accounts and no additional containment controls face a moderate to high risk of exploitation.
