The vulnerability is a use‑after‑free flaw in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized local attacker to execute code with elevated privileges. By exploiting the dangling reference, the attacker can gain higher kernel‑level access, compromising confidentiality, integrity, and availability of the affected machine.

Affected systems include Microsoft Windows 10 build 1607, 1809, 21H2, and 22H2; Windows 11 build 23H2, 24H2, 25H2, 26H2 and variants for arm64; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both standard and Server Core editions). The flaw impacts x86, x64, and arm64 architectures depending on the product version.

The CVSS base score of 7 indicates a high severity of the flaw. EPSS data is not available, so the exact likelihood of exploitation remains uncertain, but the local nature of the attack means that any user with authorized access could potentially exploit it if it remains unpatched. The vulnerability is not listed in CISA KEV, and there are no publicly known exploits at this time. However, the combination of a local use‑after‑free and the ability to attain kernel privileges makes it a significant risk for any trusted user.