A use‑after‑free condition in the Windows Device Association Service enables an attacker with local authorized access to elevate privileges. The flaw allows the attacker to manipulate a freed memory region and gain higher privilege levels on the computer. This type of memory corruption leads to a local privilege escalation vulnerability as identified by CWE‑416, compromising the integrity and confidentiality of the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025, including their Server Core installations are impacted.

The CVSS score of 7 indicates medium‑to‑high severity, but the EPSS score is not available and the vulnerability is not catalogued in CISA’s KEV list. The likely attack vector requires local authorized access, so the threat is confined to accounts that can already log on to the machine. If executed, the attacker could gain elevated privileges, enabling installation of malware or manipulation of system settings. The absence of a public exploit or demonstrable proof does not eliminate the risk, but the exploitation conditions remain limited to local users.