The vulnerability is a use‑after‑free flaw within the Windows Certificates component. An attacker who already has local authority can trigger the flaw to cause the system to read memory that has already been freed, allowing the attacker to gain elevated privileges. The weakness is categorized as improper release processing (CWE‑416). The resulting impact is an escalation of privileges on the local machine, potentially granting the attacker full control over the affected system.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2016, 2019, 2022, and 2025. The affected configurations cover both x86 and x64 platforms, and the listed ARM64 builds. All listed builds are vulnerable as long as the Windows Certificate services component includes the unpatched code.

The official CVSS score of 7 indicates a high severity. The EPSS score is not reported, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild so far. The likely attack vector is local, requiring the attacker to be an authorized user or have used code execution in a lower‑privilege context to exploit the use‑after‑free condition. If the vulnerability were exploited successfully, it would provide local privilege escalation for the attacker.