A use‑after‑free flaw in Windows Direct Composition allows an authorized local user to run code with elevated privileges. The vulnerability can be triggered when the system attempts to access a freed memory region that still contain a pointer to user data, leading to arbitrary code execution within the context of the affected process.

Microsoft Windows 10 21H2, Microsoft Windows 10 22H2, Microsoft Windows 11 23H2, Microsoft Windows 11 24H2, Microsoft Windows 11 25H2, Microsoft Windows 11 26H2, Microsoft Windows 11 23H2 (duplicate), Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows Server 2025 (including Server Core installation). The vulnerability impacts the specified versions listed above.

The CVSS score of 7.8 indicates a high severity of the issue, while the EPSS score is unavailable so current exploitation probability could not be quantified. The vulnerability has not been listed in the CISA KEV catalog. It is a local privilege escalation that requires an attacker with authorized local access, such as a logged‑in user or administrative staff, to trigger the use‑after‑free condition.