The vulnerability is a use‑after‑free flaw in the Win32 kernel subsystem that allows an authorized local attacker to elevate privileges. This flaw maps to CWE‑416. If exploited, an attacker can gain higher privileges, potentially executing arbitrary code or escalating to system level, thereby compromising confidentiality, integrity, and availability of the affected machine.

Affected Windows editions include Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2016, 2016 Server Core, 2019, 2019 Server Core, 2022, 2025, and 2025 Server Core.

The CVSS score of 7 indicates moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation is uncertain. The flaw is not listed in CISA’s KEV catalog. Because the attack requires a local attacker with an authenticated user account, the risk is mainly in environments where privileged users can run untrusted code. Low to moderate adverse impact is expected if the vulnerability is exploited, but the scope is limited to the compromised host.