The vulnerability is a race condition in the Windows Overlay Filter, along with a use‑after‑free issue (CWE‑362 and CWE‑416). An authorized local user can exploit the improper synchronization on a shared resource to obtain higher privileges. The impact is that a non‑privileged or limited user could gain elevated rights on the same system, potentially allowing further compromise of data or services.

Affected products include multiple Windows 10 releases (1607, 1809, 21H2, 22H2), Windows 11 releases (23H2, 24H2, 25H2, 26H2, 23H2, 26H1) and various Windows Server versions (2012 R2, 2016, 2019, 2022, 2025). The issue is present on both 32‑bit and 64‑bit builds, as well as ARM64‑based Windows 11 installations.

The CVSS score of 7 indicates a high severity vulnerability. Because the flaw requires local, authorized access, the likelihood of exploitation is limited to users who can run programs on the target machine. No exploitation probability is currently published and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Therefore, while it is a serious flaw, the attack surface is restricted to environments where users have local privileges unless they are compromised.