The vulnerability is a use‑after‑free condition in the Windows Overlay Filter module, which can be triggered by an authorized local attacker to gain elevated privileges. Because the flaw occurs after memory has been freed, it typically allows the attacker to execute arbitrary code with the rights of the current process, effectively turning a non‑privileged user into a privileged one. The weakness is classified as CWE‑416 and its impact is strictly local, requiring an attacker to have some level of local access to the machine.

Affected Windows operating systems include Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and various Windows Server editions from 2016 through 2025, including server core installations. All listed builds and architectures (x86, x64, arm64) are impacted, as documented by the associated Common Platform Enumeration strings.

The CVSS score of 7.0 indicates a moderate severity for local privilege escalation, but the threat is limited to authenticated users who can run or influence software that interacts with the Overlay Filter. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited yet. Exploitation requires the attacker to execute the crafted input in a context that triggers the use‑after‑free, and there is no known remote attack surface. As such, the risk is moderate but confined to local environments.