This vulnerability is a use after free flaw in the Windows Universal Disk Format File System Driver. When a victim application performs a specific sequence of file operations that free a memory buffer and later accesses it, an attacker who is already authenticated can exploit the defect to execute code with elevated local privileges. The weakness corresponds to CWE‑121, which can lead to arbitrary code execution on the affected system. The impact is limited to the user that can trigger the condition, but the resulting privileges can reach system level, allowing modifications to protected files, installation of malware, or further exploitation of the host.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012 (including Server Core), 2012 R2 (Server Core), 2016, 2019 (Server Core), 2022, and 2025. The vulnerability affects both x86 and x64 architectures and ARM64-based Windows 11 systems where the UDFS driver is present.

The CVSS score of 7.8 indicates a high severity attack potential. No EPSS data is available, so the probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. Attackers must possess local access and the capability to mount or manipulate UDFS media; thus, the attack vector is inferred to be local with a requirement for privileged or authenticated user context. Given the lack of known exploits, the risk remains primarily theoretical but the severity warrants prompt mitigation.