A use‑after‑free flaw in the Windows Spaceport.sys driver allows an authorized local user to gain elevated privileges. The vulnerability enables an attacker with legitimate or otherwise authorized access to exploit memory corruption and thereby raise the user’s privileges to an administrator level, potentially allowing full control over the affected system. The weakness is identified as CWE‑416, indicating a use‑after‑free condition that can be leveraged to bypass normal access controls.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2019, 2022, and 2025, including Server Core installations. All these operating systems incorporate the Spaceport.sys driver that is impacted by this flaw.

The CVSS score of 7.8 classifies the vulnerability as High. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector, based on the description, is local: an attacker must have authorized access to the target machine to trigger the use‑after‑free condition. Because the flaw requires exploitation of a kernel driver and local execution, remote exploitation is unlikely. However, once exploited, the attacker can achieve full system compromise due to elevated privileges. The absence of a known publicly available exploit reduces the immediate risk, but the high severity and local nature warrant prompt remediation.