This use‑after‑free in the Windows Composite Image File System allows a local attacker with authorized user context to elevate privileges. The flaw enables arbitrary code execution at a higher privilege level, compromising confidentiality, integrity, and availability of the infected machine. The weakness combines a race condition (CWE‑362) and a use‑after‑free (CWE‑416).

The vulnerability affects Windows 10 releases 21H2 and 22H2, Windows 11 releases 23H2, 24H2, 25H2 and 26H2 (both arm64 and x64), and the Windows Server 2022 and Server 2025 families, including Server Core installations. All mentioned builds are exposed unless updated with the Microsoft security patch.

With a CVSS score of 7, the flaw represents a high‑severity local privilege escalation. The EPSS score is not available, so the likelihood of exploitation remains uncertain, though the vulnerability is not listed in the CISA KEV catalog indicating no confirmed widespread exploitation. Attackers would need local access or a role that can execute code in the composite image file system; no network‑based vector is described.