This vulnerability is a use‑after‑free flaw in the Windows kernel that enables an authorized attacker to gain elevated local privileges. The flaw is identified as CWE‑416 and can be exploited by local users who have the ability to trigger a race condition that frees a kernel object before it can be reused, resulting in the execution of arbitrary code with kernel privileges. The gain of kernel rights can allow an attacker to install rootkits, bypass remediation controls, and compromise the integrity of the system.

Microsoft Windows operating systems are affected, including Windows 10 build 1607, 1809, 21H2, 22H2, and Windows 11 builds 23H2, 24H2, 25H2, 26H2, 26H1. All Windows Server editions from 2012 to 2025 and the corresponding Core installations are also impacted. Users running any of these versions on x86, x64, ARM64, or x64‑over‑ARM64 platforms should verify their build numbers.

The CVSS score of 7 indicates a medium to high severity. A local authorized attacker is required to exploit this flaw, but the use‑after‑free condition can be leveraged with relatively simple code‑injection techniques once the race window is successfully triggered. While no EPSS score is available, the lack of a KEV listing does not diminish the need for remediation, as the vulnerability can be abused in controlled internal environments. The primary attack vector is local, requiring the attacker to execute code on the machine, thus elevating privileges from a regular user to system or administrative level.