The vulnerability is a use‑after‑free flaw in the Windows Win32 Kernel Subsystem. An attacker who already has local access can trigger the bug to gain elevated privileges on the affected system, potentially moving from a standard user to a privileged account such as Administrator or SYSTEM. This flaw is classified as CWE‑416, indicating that the kernel may be accessed after a memory object has been released.

Affected releases include Microsoft Windows 10 from version 1607 through 22H2, Microsoft Windows 11 from version 23H2 to 26H1/26H2, and Microsoft Windows Server editions 2016, 2019, 2022, and 2025 (including Server Core installations). The flaw also impacts ARM64–based Windows 11 26H2. Administrators should verify their installed version against the list of affected releases.

The CVSS score is 7.0, indicating high severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not currently catalogued in CISA's KEV list. The likely attack vector is local, as the flaw requires an authorized attacker with existing access to the target machine. Once triggered, the attacker can perform privileged operations and potentially compromise the entire device.