The vulnerability is a Use‑After‑Free condition in Windows Kernel's Win32 subsystem that can be triggered by an authorized user to elevate privileges on the local system. This flaw allows a user with legitimate credentials to manipulate kernel memory and obtain higher privileges, compromising confidentiality, integrity, and availability of the affected host. The weakness is identified as CWE‑416.

Affected systems include a broad range of Microsoft Windows operating systems. Vendors are Microsoft Windows 10 (from Version 1607 through 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server releases from Server 2012 up to Server 2025. The affected platforms cover x86, x64 and ARM64 architectures across both client and server editions, including Server Core installations.

The CVSS score of 7 indicates a high potential impact for local privilege escalation. While the EPSS score is not available, the vulnerability does not appear in CISA’s KEV list, suggesting no publicly known exploit at this time. An attacker must be authenticated on the system and exploits a specially crafted input to trigger the use‑after‑free, so the attack vector is local. Given the severity and local nature, the risk remains significant until remediation is applied.