A use‑after‑free flaw in the Windows Win32 Kernel Subsystem allows an attacker who has local system access to execute arbitrary code with higher privileges. The bug is a classic memory misuse covered by CWE‑416, meaning that freed memory can be reclaimed and then accessed, which can be leveraged to bypass access controls and gain administrative level rights on the affected machine.

The vulnerability affects Microsoft Windows 11 versions 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2025 (both standard and Server Core installations). These are the precise release names listed by the vendor for the affected builds.

The CVSS score of 7 indicates a high severity for local attackers, though the EPSS score is not available and the flaw is not part of the CISA KEV catalog. Because the bug requires a local attacker who can create or influence a process in the Win32 subsystem, the attack vector is inferred to be local. The lack of a publicly reported exploit and the need for the attacker to have some local foothold reduce the immediate risk, but the impact of privilege escalation remains significant—an attacker could install arbitrary software, bypass security controls, and potentially pivot to other systems in the network.