A use‑after‑free flaw in the Windows Modern Device Management (MDM) subsystem allows an attacker who already has some level of authorization to gain elevated privileges over a network connection. The flaw is a classic memory corruption weakness (CWE‑416) that leads to execution of privileged code when a freed object is accessed again. The resulting privilege escalation can potentially allow the attacker to modify system configuration, install software, or access sensitive data that requires higher privileges.

Affected are Microsoft Windows 10 versions 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, as well as Windows Server 2019, 2022, and 2025—including both standard and Server Core installations. The vulnerability impacts both x86/x64 and ARM64 architectures as evidenced by the corresponding CPE entries for each platform.

The CVSS score of 7.1 classifies the impact as moderate to high. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation yet. However, because the attack vector requires network access from an authenticated or authorized user, the risk remains significant for environments where MDM is configured for widespread device enrollment. The exploit requires an authorized attacker to trigger the use‑after‑free, suggesting that mitigations such as applying the vendor patch or limiting MDM permissions can substantially reduce risk.