The vulnerability is a use‑after‑free in Windows kernel‑mode drivers that permits an authorized local attacker to elevate privileges. The flaw occurs when the kernel incorrectly frees memory that is later accessed, allowing the attacker to execute code with elevated privileges. This results in local privilege escalation, giving the attacker the ability to perform any action permitted by the target user’s account.

All supported editions of Windows 10 from version 1607 through 22H2, Windows 11 from version 23H2 through 26H2 (including the 26H1 variant), and Windows Server 2016, 2019, 2022, and 2025—including Server Core installations—are affected. Each listed product version is vulnerable to the described use‑after‑free flaw in its kernel‑mode drivers.

The CVSS score of 7 indicates a medium severity risk. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires an authorized local user with the ability to load a malicious kernel‑mode driver; the lack of a remote exploitation vector is inferred from the wording. Consequently, the risk is limited to environments where privileged users can install or run kernel‑mode drivers.