This vulnerability is a use‑after‑free flaw in the Windows kernel that permits an authorized local attacker to execute actions with elevated privileges. The bug arises when a free operation is performed on memory that is still referenced by a running kernel component, leading to a condition where a malicious actor can invoke privileged instructions under kernel context. Attackers can gain local administrator or system level privileges, enabling them to bypass security controls, install malware, or modify system state.

Microsoft Windows 10 releases from version 1607 through 22H2, Windows 11 releases from 23H2 through 26H2, and Windows Server releases 2012 through 2025, including Server Core editions, are affected. This spans the Windows 10, Windows 11, and Windows Server lines that support x86, x64, ARM64 architectures as enumerated in the vendor data.

The CVSS score of 7.0 indicates a high severity local privilege escalation. The EPSS score is not available, so historical exploitation data cannot be assessed, but the vulnerability is not listed in the CISA KEV catalog. An attacker requires local authorization, so the attack vector is limited to local or remote compromise that allows code execution. Given the use‑after‑free nature, exploitation likely requires a privileged context to trigger the memory condition, but once achieved, the attacker can gain system‑level rights. Consequently, the risk is moderate‑high for environments that have not applied the patch.