The vulnerability is a use‑after‑free in the Windows kernel, identified as CWE‑416, that enables an autonomous attacker to elevate privileges on the affected system. The description indicates that the bug can be exploited with a physical attack, implying that the attacker requires direct access to the machine’s hardware or to a firmware context to trigger the flaw.

Microsoft Windows 11 version 24H2, Microsoft Windows 11 version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2025, and Microsoft Windows Server 2025 Server Core installation.

The CVSS score of 6.4 denotes a medium severity, while an EPSS score of less than 1% indicates a low probability of exploitation in the broader threat landscape. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack requires a physical presence on the target device, limiting the attack surface to environments where physical security is compromised. Overall, the risk is moderate and focused on environments that allow an attacker to physically access the hardware to trigger the use‑after‑free in the kernel.