The vulnerability is a use-after-free in the Windows Win32 Kernel Subsystem. When triggered, it permits an attacker who already has local authorization to execute code with elevated kernel privileges, thereby gaining full control of the machine. Because the flaw involves arbitrary control flow in the kernel, the attacker could compromise confidentiality, integrity, and availability of the affected system.

Affected products include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019, Server 2022, and Server 2025, including Server Core installations. The issue applies to x86, x64, and arm64 architectures as listed in the corresponding CPE entries.

The CVSS score of 7.8 reflects a high level of severity. The EPSS score is not available, but the lack of a Public Exploit in the KEV catalog suggests no confirmed exploitation yet, while the local attacker model still implies a significant risk to privileged accounts. The likely attack vector requires an authorized local user to supply crafted data that triggers the use-after-free within the kernel; this leads to privilege escalation without needing remote access.