An attacker with local authorized access can trigger a use‑after‑free flaw in the Windows Search component, causing the operating system to run code with elevated privileges. This flaw is a classic use‑after‑free vulnerability (CWE‑416) that can grant an attacker administrative rights or those of the local system process, enabling them to modify system files, install malware, or compromise other users on the host. The vulnerability does not provide remote code execution or network‑based exploitation; the attacker must already be able to execute code on the target machine.

The vulnerability affects multiple recent Windows releases, including Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2019, 2022, and 2025 (including Server Core installations).

The CVSS score of 7.0 classifies the flaw as high severity. No publicly available EPSS score is reported, and it is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. Exploitation still requires local, authenticated access; an authorized user could leverage the flaw to elevate privileges. Organizations with many local accounts or privileged services are at greater risk.