A use after free flaw in the Quality Windows Audio/Video Experience (QWAVE) service allows an attacker who already has local user access to elevate their privileges. The flaw is a classic double free condition (CWE‑416) that can transform a standard user into a system account, enabling the attacker to execute code, modify or delete system files, and gain full control over the affected machine.

The vulnerability affects a wide range of Microsoft products including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025.

With a CVSS score of 7 the flaw is classified as medium severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at present. The attack vector is local; an attacker must already possess user‑level access to trigger the exploit, which limits the overall threat but still poses a significant risk if privileged user credentials are compromised.