The vulnerability is a race condition combined with a use‑after‑free in Windows Storage that allows a local user with authorization to gain higher privileges. This flaw is classified as CWE‑362 and CWE‑416. If successfully exploited, an attacker could execute arbitrary code with elevated local rights, potentially compromising the entire system. The flaw requires the attacker to be already present on the machine with sufficient local privileges to trigger the race and the use‑after‑free.

Microsoft Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server 2019, 2022, 2025, including Server Core installations.

The CVSS score of 7.0 indicates high severity. The EPSS score of < 1% indicates a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. Attack vector is local; an authorized attacker must already possess local access to trigger the race condition and use‑after‑free. Because the flaw allows privilege escalation rather than systemwide compromise, the risk is significant but confined to the compromised host.