A use after free vulnerability exists in the Windows Universal Disk Format File System Driver (UDFS). The flaw allows an authorized local attacker to execute code with higher privileges on the affected system. The weakness relates to CWE-122 (Heap-based Buffer Overflow) and CWE-190 (Integer Overflow). If exploited, the attacker can gain elevated privileges, potentially modifying system files or installing malicious software.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 7.8 rates this flaw as high severity. The EPSS score of less than 1% indicates a low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attacker must already have authenticated local access to the machine; no remote exploitation is supported by the description.