The vulnerability is a use‑after‑free bug located in the Windows Win32 Kernel Subsystem. An attacker who has local user privileges can trigger the dangling pointer, causing the system to execute arbitrary code with elevated rights. This flaw satisfies the CWE‑416 weakness and allows a user to gain kernel‑level authority, potentially compromising all data and control on the affected host.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 again, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025. All listed core and non‑core installations are vulnerable, covering both x86 and x64 architectures, as well as ARM64 for Windows 11.

The CVSS score of 7 indicates a high severity for local privilege escalation. The EPSS score is unavailable, but the lack of a KEV listing suggests it is not currently a known widely‑exploited vulnerability. The most likely attack vector is local, requiring the attacker to be authenticated or have some local presence. An unpatched system is at risk of privilege escalation to system level, allowing full control over the machine.