Use‑after‑free in the WebDAV service can be triggered by an authorized local attacker to elevate privileges. The flaw allows the attacker to manipulate program behavior after a memory block has been freed, leading to higher‑privileged execution on the affected Windows system. The impact is local privilege escalation, giving the attacker control to execute code with elevated rights and potentially compromise system integrity.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and their core installations are affected.

The CVSS score of 7.0 indicates moderate to high severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack vector is local, requiring an authenticated Windows user who can trigger WebDAV operations. If WebDAV is enabled and the account has sufficient privileges, the risk of successful exploitation is present.