The Windows Cash Drawer Protocol Provider contains a use‑after‑free flaw that can be triggered by an authenticated user on the local machine. Exploitation allows the attacker to execute arbitrary code with higher privileges, potentially compromising confidentiality, integrity, or availability of the system. The vulnerability is a classic instance of CWE‑416 and requires the attacker to have some form of local authorized access to the target.

All listed Microsoft Windows 10 releases (1607, 1809, 21H2, 22H2) and Windows 11 versions (23H2, 24H2, 25H2, 26H2, 26H1) as well as Windows Server 2016, 2019, 2022, and 2025, regardless of processor architecture, are affected. Each of these operating systems hosts the Cash Drawer Protocol Provider component that is vulnerable.

The CVSS score of 7.0 categorizes this as a high‑severity local privilege escalation. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers require local execution or the ability to run code on the target; the attack vector is thus local. Given the severity and the potential damage, prompt remediation is recommended.