The vulnerability is a use‑after‑free condition in the Windows Program Compatibility Assistant Service. An attacker with local access can trigger this flaw to gain privileges higher than the current user account. This scenario is classified as CWE-416, meaning that the service can be tricked into using memory that has already been freed, enabling a local privilege escalation.

Affected systems include Windows 10 starting from version 1607 up through 22H2, Windows 11 from 23H2 to 26H2 (including ARM64 and x64 builds), and Windows Server 2016, 2019, 2022 and 2025, with both standard and server‑core installations. All listed builds are impacted regardless of processor architecture where specified.

The CVSS score of 7 indicates a high severity risk for affected hosts. The EPSS score is less than 1%, indicating a low probability of widespread exploitation, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known public exploits at this time. Because the flaw requires a locally authorized user, any user with ordinary access could exploit it without needing remote network access.