The vulnerability is a use‑after‑free in the Windows Diagnostic Policy Service that permits an authorized local attacker to elevate privileges. The flaw is classified as CWE‑416. Because the service runs with elevated rights, an attacker can upgrade a standard user account to an administrator or higher level, compromising system integrity and confidentiality.

Affected Windows products include Microsoft Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2019 (both normal and Server Core), Windows Server 2022, and Windows Server 2025 (both normal and Server Core). These releases are listed in the CNA vendor/product list and tied to specific CPEs for the Windows 10/11/Server families.

The CVSS score is 7, indicating high severity for a local privilege escalation. No EPSS data are available, and the vulnerability is not yet in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker who already has user‑level access can trigger the use‑after‑free by interacting with the Diagnostic Policy Service. Because the flaw can grant administrative rights, the risk to an organization is significant if the attacker gains any foothold on a machine.