The vulnerability is a use‑after‑free in the Windows Win32 kernel subsystem. An authorized local user can trigger this flaw to achieve elevated privileges, enabling the compromise of confidentiality, integrity, and availability. The weakness is characterized as CWE-416.

The flaw affects Microsoft Windows 11 versions 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2025 and its Server Core installations, across both x64 and arm64 architectures as specified by the product CPEs.

The CVSS score of 7.0 indicates a moderate‑to‑high severity. The EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not yet listed in CISA KEV. The likely attack vector is a local, authorized user who can trigger the use‑after‑free by interacting with vulnerable Win32 kernel components. No network access is required, and the attacker must already have active local access.