Use-after-free vulnerability in the Windows Win32 kernel subsystem allows an attacker with local access to gain higher privileges on the host system. The flaw results in an elevation of privilege scenario where malicious code can execute arbitrary actions with elevated user credentials. The weakness is a classic use‑after‑free bug (CWE-416).

Affected operating systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; and Windows Server editions 2019 (standard and Server Core), 2022, and 2025 (standard and Server Core).

The CVSS score of 7.0 indicates a medium severity risk. No EPSS score is available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack requires local access and the execution of malicious code that triggers the use‑after‑free in the kernel, which in practice means the attacker must be authorized on the machine. If the flaw is exploited, the attacker can augment their system impact by executing commands with elevated privileges.