An attacker who has local access and sufficient privileges can exploit a use‑after‑free error in the Windows Hello authentication system. The flaw triggers when an authorized user initiates authentication, causing a dangling pointer in DeviceModeManagerPrivate::ProcessMessage to be dereferenced after the object has been freed. Exploiting this defect allows the attacker to execute arbitrary code in the context of the privileged user or elevate local privileges, effectively enabling full administrative control over the affected system.

Microsoft Windows 10 releases 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019, 2022, and 2025. The vulnerability affects both standard and Core installations and applies across x86, x64, and ARM64 architectures as listed in the CNA affected‑products.

CVSS score of 7 indicates a high‑severity local privilege escalation with moderate exploit complexity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, which suggests limited publicly known exploit usage to date. The likely attack vector requires local user authority; an attacker who can authenticate to Windows Hello can trigger the use‑after‑free and gain elevated privileges. Immediate assessment and remediation are advised to prevent potential escalation to full administrative rights.