The vulnerability is a use‑after‑free in the Windows kernel that permits an authorized local user to gain higher privileges. Successful exploitation elevates the attacker to SYSTEM level, enabling arbitrary code execution, system compromise, or persistence. This flaw is categorized as CWE‑416.

Affected products include Microsoft Windows 11 24H2, 25H2, 26H2, 26H1 (both x64 and arm64 builds), as well as Microsoft Windows Server 2025, in its full and Server Core installations.

The CVSS score of 7.0 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV, implying limited current exploitation activity. The flaw requires local authorized access to the machine; therefore, an attacker must already have a user account on the system. If they can obtain such access, they can execute the use‑after‑free payload to elevate privileges.