Use‑after‑free vulnerability in the Windows Search Component enables an authorized user with local access to obtain higher privileges on the affected system. The flaw arises from improper memory handling where an object is freed but still referenced, allowing the attacker to manipulate execution flow. As a result, the attacker can run code with elevated rights, compromising confidentiality, integrity, and availability of the machine. The weakness is identified as CWE‑416.

The vulnerability affects a range of Microsoft operating systems. According to the CNA product list it impacts Windows 10 (Version 1607, 1809, 21H2, 22H2), Windows 11 (Version 23H2, 24H2, 25H2, 26H2, and 26H1) as well as Windows Server editions – Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022 and Server 2025, including their server core installations. The issue applies to both x86 and x64 architectures and ARM64 for selected Windows 11 releases.

According to the CVSS matrix the vulnerability has a score of 7, indicating a high severity local impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that documented exploitation is not currently widespread. The attack vector is assumed to be local, requiring that the attacker already has a user session on the affected machine. Once this condition is met, exploitation can be achieved without the need for additional network or remote capabilities.