A use‑after‑free condition exists in Windows Win32k that allows a local attacker to run code with elevated privileges. The flaw, identified as CWE‑416, enables the attacker to gain administrative rights on the host system once the vulnerable kernel object is freed and reallocated. This results in potential full system compromise and the ability to bypass security controls.

The vulnerability affects multiple Microsoft Windows releases. Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 7.0 indicates moderate‑to‑high severity, and the EPSS score is unavailable, which does not negate the risk of exploitation. The vulnerability is not listed in CISA KEV, but because the flaw allows local elevation, a privileged attacker could easily compromise the system. The likely attack vector is local and requires the attacker to exploit the Win32k subsystem through an authorized session or by manipulating a trusted application. Given its nature, organizations should treat this issue with high priority.