An authorized local attacker can trigger a use‑after‑free condition in Windows Direct Composition, enabling the execution of code with elevated privileges. The flaw leads to local privilege escalation, potentially giving the attacker full control over the system and the ability to tamper with the integrity and availability of services running under the compromised account.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025. These systems are identified as affected by the CNA’s product list.

The CVSS score of 7.8 indicates a high potential impact, while the EPSS score is reported as < 1%, signifying a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely observed exploitation yet. The likely attack vector is a local attacker who already has authorization on the system, such as a logged‑in user with the ability to launch applications that use Direct Composition. With sufficient rights to construct the exploit, the attacker can elevate privileges to an administrative level, facilitating further compromise.