Windows Smart Card includes a use‑after‑free vulnerability (CWE‑416) that allows an authorized local user to execute arbitrary code with elevated privileges. If an attacker can supply a specially crafted smart‑card file or initiate a card‑related operation after the vulnerable object has been freed, the attack can result in privilege escalation to SYSTEM or another high‑privilege account. This compromise would give the attacker full control over the affected machine, enabling changes to system configuration, installation of malware, or exfiltration of sensitive data.

Microsoft Windows 10 builds 1607, 1809, 21H2 and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2 and 26H1; Windows Server 2012 through Server 2025, including core installations; and ARM64 builds of Windows 10, 11, and Windows Server. All listed versions are vulnerable to the use‑after‑free bug in the Smart Card component.

The CVSS score of 7 indicates high severity, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS is not available, so the likelihood of exploitation remains unknown, but the use‑after‑free flaw is a classic privilege‑escalation vector that has been widely abused in the past. Based on the description, the attack vector is local and requires an authorized user to supply a crafted smart‑card or trigger a smart‑card operation after the vulnerable object has been freed. The lack of a public exploit and absence from the KEV list suggest no known exploitation, but the high CVSS score signals that a competent attacker could feasibly leverage this flaw to obtain SYSTEM privileges.