A use‐after‐free flaw in Windows Direct Composition allows an authorized attacker who can execute code in the user context to gain higher privileges locally. The weakness is a memory safety violation (CWE‑416) that can be triggered during normal rendering activity, enabling the attacker to execute arbitrary code with elevated rights.

Microsoft Windows 11 versions 24H2, 25H2, 26H2, 26H1 and Microsoft Windows Server 2022, 2025 (including Server Core installations) are affected. The vulnerability spans both x64 and arm64 architectures as listed in the vendor’s advisory.

The CVSS score of 7 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The likely attack vector requires the attacker to run code within a user session that can access Direct Composition APIs, such as a malicious application or a compromised privileged process. If executed, the attacker could gain elevated privileges on the local machine.