Use‑after‑free in the Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. The flaw occurs when the service reuses a freed memory region, enabling a malicious payload to run with higher privileges than the user who triggered the event.

The vulnerability affects Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1 as well as Windows Server 2025, including the Server Core installation.

The CVSS score of 7 signals a moderate‑to‑high severity for local privilege escalation. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the absence of publicly known exploits does not diminish the risk. An attacker who has local access and can interact with the Program Compatibility Assistant Service can trigger the use‑after‑free and gain elevated privileges, making timely patching and access control critical.