A use‑after‑free flaw in the Windows Security App allows an authorized attacker to elevate privileges locally. The vulnerability arises when memory that has already been freed is accessed again, allowing the attacker to hijack the control flow and obtain higher rights. This is a classic use‑after‑free weakness (CWE‑416) that can compromise system integrity by giving the attacker access to administrative functions.

Affected systems include Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations.

The vulnerability scores a CVSS of 7, indicating a high severity local risk. The EPSS score of 0.00264 (<1%) indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. The likely attack vector is a local authorized user or malware running on the system; the attacker must be able to trigger the use‑after‑free condition, but no remote exploitation path is described.