A use‑after‑free flaw in the Windows Application Compatibility Cache allows an attacker who already has authenticated access to a target system to obtain higher privileges. The flaw can enable the attacker to execute code with elevated rights, potentially leading to full system compromise. The weakness matches the description of a use‑after‑free vulnerability (CWE‑416).

Affected releases include Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025. The issue spans x64 and arm64 builds where the compatibility cache component is present.

The CVSS score of 7.0 indicates moderate to high severity. EPSS data is unavailable and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting no confirmed exploits at this time. The likely attack vector is local, requiring the attacker to be an authorized user on the target system; once exploited, privilege elevation could be used to gain system‑wide control. Prompt application of the security update is advised to mitigate the risk.