Windows Push Notifications contains a use‑after‑free flaw that allows an authorized local attacker to gain elevated privileges on the affected system. By freeing memory prematurely and then accessing it, the attacker can execute arbitrary code within the context of the vulnerable component. This vulnerability exemplifies CWE‑416 and could allow a user with local access to increase his privileges, compromising the confidentiality, integrity, or availability of the system.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2019, Server 2022, and Server 2025 across all supported architectures (x86, x64, arm64). All of these systems run the Windows Push Notification Service, which is the component impacted by the use‑after‑free flaw.

The CVSS base score of 7 indicates moderate to high severity. The EPSS score is <1%, indicating a very low but non‑zero likelihood of exploitation. No KEV listing suggests that no publicly known exploits were available at the time. The attack vector is inferred to be local, as the flaw requires an authorized attacker with legitimate access to the system. Under these conditions the vulnerability can lead to privilege escalation, making the risk significant for organizations that keep the Push Notification Service enabled on endpoints that have untrusted local users.