A use‑after‑free flaw resides in the Windows Advanced Rasterization Platform component. Exploiting this bug allows an attacker who has local access to corrupt memory and cause the operating system to execute arbitrary code with elevated privileges. The weakness is classified as CWE‑416, which indicates a memory safety error that can lead to privilege escalation.

The vulnerability impacts multiple Microsoft Windows releases. Specifically, Windows 10 versions 1809, 21H2, and 22H2 are affected, as are Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1, and the duplicate 23H2 entry. Server editions are also impacted: Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). No precise sub‑version ranges are supplied beyond the product identifiers.

The CVSS score of 7.0 categorizes this flaw as a high‑severity weakness. The EPSS score is not reported, so the precise exploitation probability remains unknown. Because the CVE is listed as not included in the CISA KEV catalog, this specific vulnerability is not recognized as a widely exploited or publicly known exploit. The attack requires local, authorized access, meaning the threat is limited to users who can log into the affected machines. However, once local access is gained, an attacker can elevate privileges to gain administrative or system control, posing significant risks to data confidentiality, integrity, and availability for the compromised systems.