A use‑after‑free vulnerability in the Windows Perception Simulation Service allows an attacker who already has local user privileges to bypass access controls and gain higher privileges on the affected system. The flaw occurs when the service attempts to free a memory object that has already been released, enabling the attacker to execute arbitrary code with elevated rights. This could lead to compromise of sensitive system files, execution of malicious binaries, or escalation to system‑level access, thereby affecting confidentiality, integrity, and availability of the host.

Microsoft Windows 10 builds 1809, 21H2, and 22H2; Microsoft Windows 11 builds 23H2, 24H2, 25H2, and 26H2; and Microsoft Windows Server 2019 (including Server Core).

The flaw has a CVSS score of 7.8, indicating moderate to high severity. EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that active exploitation may not yet be widespread. Nonetheless, the local attacker model means that any user with legitimate access could potentially exploit the flaw to elevate privileges, making patching a priority for all affected installations.