A use‑after‑free flaw in the Windows NTFS file system enables an authenticated local user to elevate privileges, allowing the attacker to gain higher-level access on the compromised machine. This vulnerability, identified as CWE‑416, can lead to unauthorized administrative actions and compromise data confidentiality, integrity, or availability. The CVSS score of 6.7 indicates a moderate severity for this local privilege escalation scenario.

The flaw affects Microsoft Windows 11 version 24H2, Windows 11 version 25H2, Windows 11 version 26H1, Windows Server 2025, and Windows Server 2025 Server Core installations, all of which are listed by Microsoft as impacted.

Because the attack requires local user authentication, the threat surface is limited to insider or compromised accounts. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation; however, the moderate CVSS value and potential for significant privilege elevation make it a notable risk. The vulnerability is not listed in the CISA KEV catalog, but Microsoft provides a security update to remediate the flaw.