A use‑after‑free flaw in the Windows Kerberos component allows an authorized user on a local system to take advantage of memory that has already been freed. When the vulnerability is triggered, an attacker can execute arbitrary code with higher privileges than the account currently in use. This leads to a local privilege escalation that can compromise the security of the machine.

Microsoft Windows 11, version 26H1 for x64 architectures. Only the specific build identified in the CVE, and newer builds with the patch applied, are not susceptible.

The CVSS score of 7.0 categorises the issue as high severity. No EPSS score is available, so precise exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known active exploits are documented. The attack vector is inferred to be local, requiring an attacker to have legitimate access to the affected workstation.