This vulnerability is a use‑after‑free flaw in Windows Enterprise App Management. An authorized adversary can trigger the flaw to gain additional permissions on the host, allowing actions that were not originally permitted. The weakness maps to CWE‑416 and enables the attacker to gain elevated privileges, potentially leading to unauthorized system or network access.

The affected operating systems include several releases of Windows 10, Windows 11, and Windows Server. Specifically, the flaw impacts Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 variants 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both full and Server‑Core installations.

The CVSS score is 7.1, indicating a moderate to high risk. The EPSS score is not available, so the frequency of exploitation is unclear. It is not listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker who can access the Windows Enterprise App Management service over the network; exploitation requires that the attacker has sufficient authority to invoke the vulnerable operations. Successful exploitation elevates the attacker’s privileges on the host and may allow further compromise across the network.