The vulnerability is a use‑after‑free flaw in the Windows Composite Image File System. It allows a local attacker who already has authorized access to trigger a memory corruption that can lead to execution of code with elevated privileges. The weakness corresponds to CWE‑416 and can be leveraged to gain administrative or SYSTEM level rights, compromising confidentiality, integrity, and availability of the affected system.

Microsoft Windows 11 versions 24H2, 25H2, 26H2 and 26H1, as well as Microsoft Windows Server 2022 and Windows Server 2025 (Server Core installation) are impacted by this flaw.

The CVSS score of 7 indicates a medium‑to‑high severity. The EPSS score is not available, so the current estimate of exploitation likelihood is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known exploits in the wild yet. The attack vector is local and requires an authorized user context, although the weakness could allow the attacker to pivot to higher privileges once the bug is triggered.