Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges over a network. This flaw involves a likely invalid reference to freed memory, giving the attacker the ability to execute code with higher privileges than usual, impacting confidentiality, integrity, and availability of the affected systems.

Microsoft Windows 10 Build 1809, 21H2, 22H2; Microsoft Windows 11 Build 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2019, 2022, 2025 across all standard 32‑bit, 64‑bit, and ARM64 options. All network‑connected instances with the PrintWorkflowUserSvc service enabled are vulnerable.

The CVSS base score of 7.1 indicates a high‑severity flaw requiring authenticated or privileged network access. The EPSS score is unavailable, so the likelihood of exploitation in the wild is unknown. The vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a network‑based attacker who can inject crafted requests to the PrintWorkflowUserSvc service to trigger a use‑after‑free condition, thereby elevating local privileges and potentially taking full control of the machine.