The flaw is a use‑after‑free in Windows Hello that lets an authorized local attacker execute code with elevated privileges. The attacker must already have local access to the device; once the defect is triggered the attacker can gain administrative rights or run arbitrary code as SYSTEM. This vulnerability is identified as CWE‑416 and can severely compromise the confidentiality, integrity, and availability of the affected system.

The security update affects Microsoft Windows 10 build 21H2 and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2, and the 26H1 build. These include x86, x64, arm64 variants as noted in the Microsoft Advisory.

The CVSS base score is 7, classifying it as high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploited instances to date. Nevertheless, because the flaw enables local privilege escalation, attackers with physical or local administrative access can exploit it. Environments with users who have remote desktop or local administrative rights pose the highest risk. Prompt mitigation is recommended.