A use‑after‑free flaw in the Windows kernel’s DirectX graphics subsystem allows an attacker who can run code locally to corrupt memory and gain kernel‑mode execution, thereby elevating privileges to system level. This is a classic CWE‑416 problem caused by the improper release of a freed resource, and it gives the attacker full control over the compromised device.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 24H2, 25H2, 26H1; Microsoft Windows Server 2016, 2019, 2022, 2025 (both standard and Server Core installations).

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, meaning no known large‑scale attacks have been reported. Based on the description, the likely attack vector is local code execution by an authorized or privileged user, who would need to deliver a malicious DirectX workload or trigger a memory corruption scenario to activate the use‑after‑free and achieve elevated privileges.