The vulnerability is a use‑after‑free bug in the Windows Text Services Framework. It can be triggered by an authorized local user supplying malicious input to a vulnerable component, causing the framework to free memory that is still in use. When the bug is triggered, the attacker may execute code with higher system privileges on the same host, as stated by the CVE description. No additional functional impact details are disclosed in the official statement.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2 through 26H2 (including 26H1); and Windows Server 2012 through 2025, including all Server Core installations. The flaw applies to x86, x64, and ARM64 architectures where the Text Services Framework component is present.

The CVSS score of 7.8 classifies the flaw as High severity. The EPSS score is not reported and the vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploitation. The likely attack vector is local; an attacker must already have legitimate user access to the target computer to trigger the use‑after‑free. Once exploited, the attacker’s privilege level increases, threatening confidentiality, integrity, and availability on that host. The weakness involved is a use‑after‑free bug (CWE‑416).