This use‑after‑free flaw in the Windows Update Orchestrator Service allows a local user with authorized access to trigger a memory corruption that can read or overwrite arbitrary memory. By manipulating the corrupted memory, the attacker can execute code with elevated privileges, potentially reaching SYSTEM or other privileged accounts. The weakness is identified as CWE‑416, indicating unsafe memory access that can lead to privilege escalation.

Affected versions include Microsoft Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2025, including the Server Core installation. Both x64 and ARM64 architectures are impacted.

The CVSS score of 7 indicates a high‑moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation at the time of this analysis. The attack vector is local, requiring an authorized user who can execute code on the system. Once the flaw is triggered, the attacker can elevate privileges, compromising system integrity and enabling further lateral movement. The risk is significant for any environment where users have local code execution rights.