A use‑after‑free bug in the Windows Shell allows an authorized desktop user to execute code with elevated privileges. The flaw is a classic memory safety violation (CWE‑416) that can be triggered when a Shell object is freed and a subsequent operation assumes the memory remains valid, allowing the attacker to overwrite return pointers or data structures that influence privilege checks. The result is that the attacker can gain administrative rights on the local machine, compromising integrity and availability of the system.

Microsoft Windows 11 releases 23H2, 24H2, 25H2, and 26H1 as well as Windows Server 2025, including Server Core installations, are affected. The vulnerability is present in both ARM64 and x64 builds of the documented versions.

The CVSS score of 7.8 places the vulnerability in the medium‑to‑high severity range. Exploitation requires local, authorized access and relies on a memory corruption condition that is deterministic once the Shell context is present. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating there are currently no publicly known active exploits. Nevertheless, because the attack can occur from any logged‑in user and results in full administrative rights, the risk to affected systems remains high.