The flaw is a use‑after‑free vulnerability in the Windows Audio Service that permits an authorized local user to elevate privileges to full administrator rights. This elevates attacker control and potentially allows arbitrary code execution under an elevated account. The weakness is classified as CWE‑416, which reflects a memory safety issue that can be abused by an attacker with local access.

Affected windows installations include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2 as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1. Server editions that are impacted are Windows Server 2016, 2019, 2022 and 2025, including Server Core variants. Specific kernel or service component versions are not enumerated beyond these OS releases.

The CVSS score of 7.0 places this vulnerability in the moderate‑to‑high severity range. Because the EPSS score is not available, the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, which suggests no confirmed widespread exploitation yet. An attacker must already have local authorized access to a system; from that position the use‑after‑free can be triggered to gain elevated administrative privileges. No remote attack vector is described, and exploitation appears to depend on local privileges and the ability to manipulate the audio service.