A use‑after‑free condition in Internet Explorer allows a local attacker with authorized access to execute code with higher privileges than the original process. This flaw results from memory that is freed and later reused, enabling code execution that can bypass normal permission boundaries. Because the vulnerability is local, an adversary must already have user-level access to the target system to exploit it.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2019 (standard and core), Windows Server 2022, and Windows Server 2025 (standard and core).

The CVSS score of 7.8 categorizes this as a high severity flaw, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker already to be authenticated or otherwise authorized on the target machine, making the attack vector local. Attaining higher privileges can enable the execution of arbitrary system commands, compromise data integrity, and provide a foothold for further lateral movement within the environment.