A use‑after‑free bug in Microsoft Windows Search an attacker who already has local access to execute arbitrary code with elevated privileges. The flaw triggers the CWE‑416 condition and can let the attacker gain administrative rights, install malware, or alter system configuration affecting the entire operating system.

Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012 through 2025, including standard and Server Core installations, are affected as listed by CNA.

The CVSS score of 7.0 denotes a medium‑to‑high severity, and the EPSS score of less than 1 % indicates a low probability of widespread exploitation at present; it is not included in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to be logged on or have physical access. Once the use‑after‑free is triggered, privileged code execution can occur.