Use after free in Windows Win32K allows an authorized local attacker to gain elevated privileges. This local privilege escalation flaw (CWE-416) arises when memory is freed and then reused, enabling the attacker to execute code at higher privilege levels, potentially compromising system integrity and confidentiality for the affected account.

Affected Microsoft operating systems include Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and the corresponding Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, including server‑core installations. Both client and server builds listed in the CNA data are impacted.

The CVSS score of 7.8 indicates a moderate‑to‑high severity local exploitation risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attack vector is local and requires the attacker to have authorized access or the ability to execute code in a user context. While feasible to exploit, it remains confined to systems where the attacker has a foothold, such as compromised local accounts or remote desktop sessions, making it a significant risk in environments with high privileged user activity.