The vulnerability is a use‑after‑free in the Virtual Hard Disk (VHD) Miniport Driver that lets an authorized local attacker gain elevated privileges on the system. The flaw allows the attacker to corrupt the caller‑side state after the driver has freed a structure, enabling execution of code or other privileged operations with the rights of the affected user. Because the flaw exploits an improper use of freed memory, it is classified under CWE‑416 and results in privilege escalation rather than a denial‑of‑service or remote code execution scenario.

Affected systems include multiple Microsoft Windows releases. Desktop editions such as Windows 10 1607, 1809, 21H2, and 22H2, as well as Windows 11 23H2, 24H2, 25H2, and 26H1, are impacted. Server editions up to Windows Server 2025, including Server 2016, Server 2019 and Server 2022, are also affected. All affected builds are susceptible regardless of architecture (x86, x64, arm64), as the vulnerability resides in the common VHD driver component.

The CVSS base score of 7.0 indicates a high severity local privilege escalation risk. The EPSS score is not provided, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires local access and the ability to create or manipulate a VHD file that is opened by the Miniport Driver. An attacker who can supply a specially crafted VHD to a privileged process can trigger the use‑after‑free and gain elevated rights. Because the flaw is local, the vector does not involve remote network exploitation, but it can be leveraged in environments where privileged users have control over local storage resources.