A use‑after‑free flaw in the Windows Wired AutoConfig Service allows an authenticated local user to obtain elevated privileges on the affected system. The flaw occurs when the service re‑references memory that has already been freed, enabling control over privilege escalation flows. Because the vulnerability is confined to a locally privileged user, it can be abused to create administrative accounts, install malware, or modify system configurations. The weakness is classified as CWE‑416, indicating a memory management issue that undermines isolation between processes or threads.

Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (builds 23H2, 24H2, 25H2, 26H2, 26H1, 23H2), and Windows Server editions from 2012 through 2025, including both regular and server core installations. All affected releases run the Wired AutoConfig Service, which monitors network interfaces and can be triggered by local actions that exploit the use‑after‑free condition.

The CVSS score of 7.8 indicates a moderate to high risk if a local attacker can exercise privileges. The EPSS score is currently unavailable, but the fact that the vulnerability exists in mainstream Windows releases raises significant concern. The issue is not listed in the CISA KEV catalog; nevertheless, the local attacker model means only users with legitimate access can exploit it, which reduces the scope compared to remote attacks.