A use‑after‑free flaw in the Windows Program Compatibility Assistant Service allows a local attacker who already has authorized access to raise their privileges on the system. The weakness, identified as CWE‑416, grants the attacker the ability to execute higher‑privileged code, potentially compromising system confidentiality, integrity, and availability by enabling installation of unauthorized software or alteration of system settings.

Microsoft Windows 11 releases 23H2 through 26H2 for both arm64 and x64 architectures, including Windows 11 26H1, and Microsoft Windows Server 2025 (including Server Core). The vulnerability affects all listed editions and builds described in the CNA vendor statements.

The CVSS score of 7 denotes moderate severity. While the EPSS score is currently unavailable, the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been observed. The likely attack vector is a local authorized user who can trigger a use‑after‑free by interacting with the service; remote exploitation is not supported by the current description.