The vulnerability is a use‑after‑free flaw in the Windows Win32k kernel subsystem. When an authorized local attacker triggers the bug, they can execute code in kernel mode, granting them full administrative control or the ability to run arbitrary code with system rights. The flaw falls under CWE‑416 and can compromise confidentiality, integrity, and availability of the affected system.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases from 2012 through 2025, including Server Core editions.

The CVSS base score of 7 indicates high risk, and the attack vector is local, requiring an authorized user on the machine. No public exploit or CEV is listed in CISA’s KEV catalog, and the EPSS score is not available, suggesting limited evidence of widespread exploitation. Nevertheless, the use‑after‑free nature of the flaw allows an attacker to bypass security boundaries once authenticated, making it a high‑urgency issue for administrators.