A use‑after‑free flaw exists in the Win32K ICOMP component that allows an attacker with local access to execute privileged code. The vulnerability enables the attacker to compromise the integrity of the operating system by escalating permissions from a non‑administrator to an administrator. The weakness is a classic memory corruption error, classified as CWE‑416.

Microsoft Windows 11 24H2, 25H2, 26H2, and 26H1, including both x64 and ARM64 builds, as well as Microsoft Windows Server 2025 (full and Server Core installations). All affected versions are listed in the vendor’s advisory and are reachable via the Security Update Guide.

The CVSS score of 7 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires local code execution and authorized access, the attack vector is likely via a compromised local account or an application with elevated privileges. Exploitation would permit an attacker to gain administrative access, potentially enabling spread of malware, persistence, and further compromise of the environment. The combination of a high CVSS score and the local nature of the attack suggests that a timely patch is essential to mitigate the risk.