The vulnerability is a use‑after‑free condition in the Windows Console Driver that permits a logged‑in user to gain elevated privileges by corrupting memory during console operations. This flaw, identified as CWE‑416, can be leveraged to execute code at higher privilege levels, enabling installation of malware, modification of system settings, or theft of data. The impact is a local privilege escalation that endangers any user with legitimate access to the affected operating system.

Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025—including Server Core variants—are all affected. The issue spans x86, x64, and ARM 64 architectures as documented in the vendor release notes. No additional hardware or network components are listed as vulnerable.

The vulnerability carries a CVSS score of 7, indicating high severity for a local attacker with access to the affected OS. With no EPSS score reported and the flaw not present in the CISA KEV catalog, the current exploitation likelihood is unclear, yet the lack of observed active exploitation does not diminish the risk due to the relatively straightforward access required. Attackers need to be logged in with a user who can invoke console operations; post‑exploit, they can elevate to full system control, increasing the attack surface of the compromised device.