A use‑after‑free flaw in Windows Hello enables a locally authenticated attacker to acquire elevated privileges on the host. The vulnerability permits exploitation of improperly freed memory, allowing the attacker to run code with higher privileges than the user context.

Microsoft Windows 10 version 21H2 (x86), Windows 10 version 22H2 (x64), Windows 11 version 23H2 (ARM64 and x64), Windows 11 version 24H2 (ARM64), Windows 11 version 25H2 (ARM64), Windows 11 version 26H1 (x64).

The CVSS score of 8.8 signals a high‑severity local privilege escalation. EPSS information is not available, but the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. The description states that an "authorized attacker" can exploit the failure, meaning the attacker must already have local access to the machine. No network exposure is required, and the flaw resides in the Windows Hello biometric component. Overall risk is significant for environments that enable Windows Hello or expose the vulnerable component to authorized users.