The vulnerability is a use‑after‑free in the Windows Update Service that can be triggered by an authorized local user, allowing the attacker to execute code with elevated privileges. This flaw could lead to full control of the compromised system, including the ability to install malicious software, modify system settings, and access sensitive data. It is classified as a local privilege escalation vulnerability under CWE‑416.

Affected systems include Microsoft Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and 23H2 (arm64 and x64), as well as Windows Server 2019, 2022 and 2025, including Server Core installations. All listed platforms run the Windows Update Service component that implements the vulnerable code path.

The CVSS score of 7 indicates a moderate severity local privilege escalation. No EPSS information is available, so the likelihood of exploitation cannot be assessed quantitatively; the vulnerability has not yet been listed in the CISA KEV catalog. The attack requires a local user context capable of running Microsoft Update files, implying that the threat vector is local, and an attacker must obtain authorized system access to trigger the use‑after‑free. Once triggered, the privileged escalation can be exploited immediately without additional steps.