Use‑after‑free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. The vulnerability arises from an improper handling of memory in the Event Tracing component, classified as CWE-416.

Microsoft Windows 10 releases 1607 through 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server releases 2016, 2019, 2022, and 2025 are affected; the affected architectures include x86, x64, and ARM64 as indicated by the update guide.

With a CVSS score of 7, the vulnerability presents a moderate‑to‑high severity. An EPSS score of less than 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a local user with authorized access; the attack vector is local and no public exploit has been disclosed.