The vulnerability is a use‑after‑free bug that occurs within the Windows Shell component. When an attacker with local authorisation exploits the flaw, the operating system incorrectly reuses a freed memory reference, allowing the attacker to execute code with elevated privileges. The primary consequence is that a user who can run local processes can gain administrative rights or otherwise bypass user‑level restrictions, potentially compromising system integrity and confidentiality.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1 and Microsoft Windows Server 2025 (Server Core installation) are impacted. Both ARM64 and x64 architectures for the Windows 11 releases are affected, while the Server 2025 release is impacted regardless of architecture.

This flaw has a CVSS score of 7, indicating moderate to high severity. The EPSS score is not available, so the current likelihood of exploitation in the wild is unknown; however, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to be authenticated or otherwise authorised to run processes on the target machine. If successfully exploited, an attacker can gain system‑level permissions, bypassing normal access controls and potentially escalating privileges further.