A use‑after‑free flaw exists within the Windows Modern Device Management (MDM) component. When an authorized attacker exploits this flaw, they can elevate local privileges, enabling them to perform actions that require higher permission levels. The weakness is a classic use‑after‑free scenario (CWE‑416).

The vulnerability affects multiple Microsoft Windows client and server releases. Specifically, Windows 10 (v1607, v1809, v21H2, v22H2), Windows 11 (v23H2, v24H2, v25H2, v26H2, v23H2, v26H1), Windows Server 2012 R2 (both feature and core installations), Windows Server 2016 (both feature and core installations), Windows Server 2019 (both feature and core installations), Windows Server 2022, and Windows Server 2025 (both feature and core installations).

The CVSS score of 7.8 indicates a high severity for privilege escalation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but this lack of risk metrics does not diminish the impact. The attack requires the attacker to be already authorized on the target system, suggesting a local attack vector with no known remote trigger. Given the high severity and the nature of the flaw, the risk to affected systems is significant if an attacker can execute code with appropriate access.