A use‑after‑free flaw exists in the Windows Defender Firewall Service. An attacker who has local authorized access can trigger the bug and elevate privilege on the system, thereby compromising system integrity and potentially gaining administrative control. The weakness follows the typical pattern of a use‑after‑free vulnerability (CWE‑416) that corrupts memory and alters program flow.

The vulnerability affects Microsoft Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2025, including its Server Core installation. Both arm64 and x86_64 versions of Windows 11 and the server operating system are vulnerable as identified by the provided CPE strings.

The CVSS score of 7.8 classifies the issue as high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue. Because the flaw can only be triggered by an authorized local user, remote exploitation is not described. Once the use‑after‑free condition is achieved, the attacker can elevate privilege and run code with elevated privileges.