The vulnerability is a use‑after‑free flaw in the Connected User Experiences and Telemetry component of Windows. When triggered, an attacker can cause the program to access memory after it has been freed, allowing the attacker to execute arbitrary code with the privileges of the affected process. This can lead to a local privilege escalation attack, enabling the attacker to gain higher privilege levels on the compromised machine.

Microsoft Windows 11 in the 23H2, 24H2, 25H2, 26H2 and 26H1 releases, as well as Windows Server 2025 (including Server Core installations) are affected by this flaw. The vulnerability applies to both x64 and arm64 architectures for the listed releases.

The CVSS score is 7, indicating a high severity impact. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authenticated or authorized user context to exploit. An attacker with such access can trigger the use‑after‑free to elevate privileges, potentially taking full control of the system.