This vulnerability is a use‑after‑free bug in Windows Cryptographic Services that enables a malicious actor who has network access to a target system to execute arbitrary code on that system. The flaw allows the attacker to free an object and then manipulate the resulting pointer to cause the service to run attacker‑supplied code, potentially leading to full system compromise. The weakness is categorized as CWE‑416 and can affect confidentiality, integrity, and availability if exploited.

Affected versions include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 arm64, 26H1 x64; and a range of Windows Server releases from 2012 through 2025, covering both server core and full installations. The vulnerability is present in the Cryptographic Services component across all listed builds.

The CVSS score of 7.5 classifies this as a high‑severity asset compromise risk, and the EPSS score is currently not available, so the likelihood of exploitation cannot be quantified from the CVSS alone. The vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been documented as being widely exploited in the wild. The attack vector is network‑based, requiring the attacker to send a crafted request to Cryptographic Services; the description indicates that the attacker must be authorized, implying that the flaw is exploitable by insiders or through elevated local privileges that are reachable over the network.