A use‑after‑free flaw in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already has local access to a system to prematurely access memory that has been freed, enabling elevation of privileges. This can let the attacker execute arbitrary code or modify system configuration with higher privileges. The vulnerability is a classic race condition defect (CWE‑362).

Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2, and Windows 11 releases 23H2, 24H2, 25H2, 26H2, including both x86, x64, and arm64 architectures, as well as Microsoft Windows Server 2012 through Windows Server 2025 in all supported build editions.

The CVSS score of 7 indicates medium‑to‑high severity. The EPSS score is unavailable, so the likelihood of exploitation cannot be quantified from current data. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits have been reported yet. The attack vector is presumed to be local, requiring the attacker to have some form of already authorized access to the target machine, such as user or local administrator credentials. The flaw arises from improper lifetime handling of memory in the UDFS driver.