The vulnerability is a use‑after‑free flaw in the Windows kernel that allows an attacker with local access to gain elevated privileges. An authorized attacker could exploit the flaw to run code with higher rights, potentially compromising the confidentiality, integrity, and availability of the system. The weakness is classified as CWE‑416, indicating memory misuse through a freed object remaining in use.

Affected products include Microsoft Windows 11 version 23H2 and Microsoft Windows Server 2025, including the Server Core installation. The vulnerability is present on both x64 and arm64 builds of Windows 11 23H2, as well as on all architectures of Windows Server 2025. Any environment running these operating systems without the vendor's patch may be vulnerable.

The CVSS score of 7 indicates a high severity, but the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires that the attacker have local code execution privileges, suggesting that a user with sufficient authority could trigger the flaw. The potential for privilege escalation makes the risk significant for organizations running the affected systems.