This vulnerability arises from an "use after free" flaw in the Windows DHCP Client that allows an authorized attacker to execute code locally on the affected system. The flaw is classified as CWE-416, indicating improper use of freed memory which can lead to unintended code paths be exploited. If successfully triggered, the attacker can run arbitrary code with the privileges of the DHCP Client process, potentially gaining higher privileges on the host.

Microsoft Windows 11 versions 24H2, 25H2, 26H1 and Microsoft Windows Server 2025 (including Server Core) are affected, with ARM64 architectures in the 24H2 and 25H2 releases and x64 in the 26H1 release.

The CVSS score of 7.0 indicates a high severity for local vulnerabilities. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to have local or authorized access to the machine, as the description specifies an "authorized attacker"; therefore, the exploitation potential is confined to environments where privileged users are present, yet the ability to execute arbitrary code makes it a critical local threat.