A use‑after‑free bug in Windows Storage allows a local, authorized user to trigger a race condition and improper memory access, which can elevate user privileges to the system level. The weaknesses correspond to CWE‑362 (Race Condition) and CWE‑416 (Use After Free). Successful exploitation would give the attacker unauthorized control over the affected machine, potentially compromising confidentiality, integrity, and availability.

Microsoft Windows 10 releases 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2 and 26H1. Server editions impacted include Windows Server 2019 (both standard and Server Core), Windows Server 2022, and Windows Server 2025 (both standard and Server Core). The affected systems cover x86, x64, and ARM64 processors.

The CVSS base score is 7.0 and the EPSS score is not available, indicating no disclosed public exploits at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authenticated or authorized user to initiate the offending storage operation. No remote exploitation path is described; the risk is moderate but the potential impact remains high, urging timely remediation.