This vulnerability is a use‑after‑free bug in the Windows Win32K subsystem that allows a malicious actor with local user privileges to gain higher rights on the machine. The flaw stems from improper handling of memory after it has been freed, enabling the attacker to inject or execute code that manipulates protected system state. The impact is that an attacker can elevate to administrative level on the compromised device, potentially accessing, modifying, or exfiltrating sensitive data and installing malware.

Affected are Microsoft Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2019 (both standard and Core), Windows Server 2022, and Windows Server 2025 (both standard and Core).

The CVSS score of 7.8 indicates a moderate to high risk. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector requires local, authorized access; an attacker must run malicious code on the host, possibly through a compromised application or a script. Once executed, the use‑after‑free can lead to privilege escalation to an Administrator or system account, exposing the device to further compromise.