A use-after-free flaw in Windows Direct Composition can be triggered by an authorized user to gain higher system privileges than originally possessed. The flaw permits execution of arbitrary code with elevated rights, which could allow modification of system files, installation of hidden software, or further lateral movement. This vulnerability is categorized under CWE‑416, indicating that memory is accessed after it has been freed.

Affected products include Microsoft Windows 10 versions 21H2 and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, Microsoft Windows Server 2022, and Microsoft Windows Server 2025, including Server Core installations. Specific CPE identifiers confirm the impact spans x86, x64, arm64, and arm64‑based systems.

The CVSS score of 7.8 places this issue in the high‑severity range, and while the EPSS score is not available, the lack of a KEV listing suggests no publicly known active exploitation yet. The likely attack vector is local; an authorized user with normal privileges can exploit the flaw to launch code execution with elevated rights. The risk is significant for systems that run services or applications with elevated privileges, and for environments where an attacker could gain initial foothold while preserving the ability to perform privileged actions.