A use‑after‑free flaw in the Windows kernel allows an attacker who is already authorized on the local machine to read privileged data. The vulnerability is confined to confidentiality compromise, giving the attacker access to potentially sensitive system or user information without remote access.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. The same applies to server core installations of the 2012 and 2016 platforms.

The CVSS score is 4.7, indicating moderate severity; no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. It requires local authority and an authenticated user, so an attacker needs to have legitimate access to the system. Because the flaw involves a use‑after‑free in kernel memory, exploitation would likely exploit an existing kernel operation to read arbitrary memory, leading to confidential data exposure. Given the limited attack vector, the overall risk is moderate but still warrants timely remediation.