This vulnerability is a use‑after‑free flaw in the Windows COM+ Event System Service. An attacker who can run code on the target system can trigger the fault, potentially executing arbitrary code with elevated SYSTEM privileges. The flaw is classified as CWE‑416 and enables a local privilege escalation that could allow the attacker to gain administrative access, install malware, or compromise system integrity.

The flaw affects a wide range of Microsoft Windows operating systems. Supported versions include Windows 10 from 1607 to 22H2, Windows 11 from 23H2 through 26H2 (including ARM64 and x64 builds), and Windows Server from 2012 through 2025, both full and Server Core installations.

The CVSS score of 7.0 indicates a high severity risk, though the EPSS score is not available and the vulnerability is not listed in the KEV catalogue. Exploitation requires a user that already has local execution privileges to invoke the COM+ Event System Service in a manner that exercises the freed memory. Once triggered, an attacker can gain full SYSTEM rights. Administrators should consider this risk high and apply the update promptly to eliminate the attack vector. As the exploit remains theoretical without public proof, the likelihood of an active attack may be modest, but the potential impact is severe.