A use‑after‑free flaw exists in the Windows Search component that can be triggered by an attacker who is already authenticated on the machine. The flaw allows the attacker to corrupt memory and eventually obtain elevated privileges, effectively letting a low‑level user climb to administrator rights. This vulnerability is classified as CWE‑416 and presents a significant local escalation risk.

The vulnerability affects multiple Microsoft operating systems, including all Windows 10 releases from version 1607 through 22H2, Windows 11 releases from 23H2 through 26H2 (including 26H1), as well as server editions Windows Server 2012 (standard and core), 2012 R2 (standard and core), 2016, 2019, 2022, and 2025.

The CVSS score of 7 indicates a high risk severity. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been documented. The attack requires local, authorized access and exploitation of the vulnerable Search component; therefore, the most likely vector is a privileged local account or a user with write access to the search index. Given the evidence, administrators should consider the flaw a high‑priority patch candidate and monitor for related activity.