The vulnerability is a classic use‑after‑free flaw in the Windows Local Security Authority Subsystem Service (LSASS). The flaw allows an attacker who already has the ability to run user‑mode code on the target machine to free a memory region and later reuse it. When successfully exploited, this can lead to the execution of arbitrary code with the privileges of the LSASS process, effectively elevating the attacker’s privileges to full system control. The weakness is classified as CWE‑122 (Buffer or Handle Management Evasion).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations).

The CVSS score of 7.8 indicates a high severity impact, while the EPSS score is not available, so the likelihood of exploitation in the wild is unknown. The vulnerability is not listed in the CISA KEV catalog, which suggests no publicly known exploitable proof‑of‑concepts are current, though the attack requires local access and an authorized user. The likely attack vector is local because the flaw can only be triggered by code executed on the target system, probably by a malicious application or a user with existing compromised credentials.