The vulnerability is a use‑after‑free in the Windows Search service, which allows an attacker with normal user privileges to gain higher authority on the same machine. Following CWE‑416, exploitation can lead to arbitrary code execution under the service’s system context, giving the attacker full control of the host.

Affected are Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including core installations).

The CVSS score of 7 indicates moderate‑to‑high severity, and exploitation requires a local, authenticated attacker. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; a malicious user could trigger the use‑after‑free with crafted input or a malicious command that the Search service processes, potentially resulting in full host compromise.