The vulnerability is a use‑after‑free in the Windows kernel that, when triggered by an authorized local user, allows elevated privileges. An attacker who can execute code on the local machine can exploit a freed memory reference to bypass integrity checks and gain higher privileges, enabling full control of the affected system. The flaw stems from improper memory management identified as CWE‑416.

Microsoft Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Version 23H2, 24H2, 25H2, 26H2, Windows 11 version 26H1, Windows Server 2022, Windows Server 2025, and Server Core variants of Windows Server 2025. The affected versions include all 64‑bit builds and specific ARM and x86 variants as listed by Microsoft.

The CVSS base score of 7.8 categorizes this flaw as high risk. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack requires an authenticated local user with the ability to run code on the target system and sufficient memory addresses to trigger the use‑after‑free. Once the flaw is triggered, the attacker can gain administrative rights for the machine rooted in the kernel.