The vulnerability is a use‑after‑free error in the Windows Shell that can be triggered by an authorized local user. When exploited, the flaw can lead to the elevation of system privileges, allowing an attacker to execute arbitrary code with higher rights. This type of attack can compromise confidentiality, integrity, and availability of the affected system by granting unrestricted access to sensitive data and system configuration.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1. Windows Server environments also impacted are Server 2012 (and core), Server 2012 R2 (and core), Server 2016 (and core), Server 2019 (and core), Server 2022, and Server 2025. All listed operating system editions are vulnerable to local privilege escalation through this flaw.

The CVSS score of 7.8 indicates high severity. No EPSS score is provided, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is local; an attacker must have authorized user access to the victim machine to trigger the use‑after‑free condition. Successful exploitation could grant the attacker full control over the system.