A use‑after‑free flaw in the Windows Audio Service allows an attacker who already has local system access to gain elevated privileges. This vulnerability permits the victim to execute code with higher permissions than originally available, compromising system integrity and potentially facilitating further attacks. The weakness is identified as CWE‑416, a classic use‑after‑free pointer error.

Affected versions include multiple releases of Windows 10 (1809, 21H2, 22H2), and Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), as well as Windows Server 2019, Server 2022, and Server 2025, with various architecture support such as x86, x64, arm64, and server core installations. The issue has been documented for both client and server builds.

The CVSS score for this flaw is 7, indicating a medium to high risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an authorized or user‑level presence on the target machine. Once the attacker activates the use‑after‑free condition, they can hijack the service to execute arbitrary instructions with elevated privileges, thereby compromising confidentiality, integrity, and availability of the affected system.