A use‑after‑free condition in the Windows Program Compatibility Assistant Service allows an attacker with local authority to gain elevated rights. The flaw permits bypassing normal privilege boundaries, enabling an attacker to perform actions that normally require higher privileges, such as installing software, modifying system settings, or accessing protected resources. The weakness corresponds to CWE‑416, which denotes a memory management bug leading to potential privilege escalation.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core).

The CVSS score is 7.0, indicating moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified; however, because the vulnerability requires local user access, it poses a serious risk to systems where privileged processes run. The flaw is not listed in the CISA KEV catalog and no public exploit has been reported at this time, but the potential impact remains significant.