Use after free in the Windows kernel allows an authorized local user to execute code with elevated privileges, which can compromise the entire system by enabling data theft, persistence, or further attacks. The flaw originates from a failure to correctly manage freed memory, creating a path for privilege escalation. Since the vulnerability is in the kernel layer, exploitation would grant the attacker full system access.

Affected Microsoft operating systems include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations. These releases contain the vulnerable kernel code that may be triggered by a local user with administrative privileges.

The CVSS score of 7.8 indicates a moderate‑to‑high severity. EPSS data is currently unavailable, so the exact exploitation likelihood cannot be quantified. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation incidents. The likely attack vector is local and requires an authorized user to execute privileged code to exploit the use‑after‑free condition. Applying the patch removes the exploitation path altogether.