Use after free in the Windows Bind Filter Driver allows an authorized local attacker to elevate privileges. The flaw permits the attacker to manipulate driver memory after it has been freed, giving them the ability to execute privileged actions that should otherwise be restricted. The impact is a local elevation of privilege.

Microsoft Windows 11 builds 23H2, 24H2, 25H2, 26H2 and 26H1, covering both x64 and ARM64 systems, are affected. Microsoft Windows Server 2025, including the Server Core installation, is also impacted. These products are listed in the CNA advisory and include the corresponding driver updates.

The CVSS score of 7 denotes a medium‑to‑high severity for a local attacker. The EPSS score is not available, so the probability of exploitation remains uncertain, but the lack of a KEV listing means no widespread or commercial exploitation has been reported yet. The vulnerability requires an attacker who can run code on the target machine; any local user able to load malicious payloads via the Bind Filter Driver could trigger the use‑after‑free and gain elevated privileges.