This vulnerability is a use‑after‑free flaw in the Windows ALPC subsystem. It permits an authorized local attacker to exploit memory corruption and gain elevated privileges on the affected machine. The weakness is identified as CWE‑416, exposing the kernel process to incorrect deallocation of memory. The impact is that a non‑privileged user who can execute code on the target becomes a user with higher privileges, potentially allowing system takeover.

Affected Microsoft Windows operating systems are Windows 10 (versions 1809, 21H2, 22H2, x86), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1 including arm64 builds), and Windows Server editions including 2019 (both default and Server‑Core), 2022, and 2025 (both standard and Server‑Core).

The CVSS score of 7 indicates a high severity vulnerability. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the use‑after‑free nature and local attack vector provide a realistic path for privilege escalation. An attacker would need to be authenticated on the local system, which is a practical threat as many administrators use local accounts or have OEM manufacturing access. The knowledge of the flaw suggests that exploitation is plausible if an attacker can trigger the use‑after‑free condition, though no public exploits are documented at this time.