The vulnerability is a use‑after‑free flaw in the Windows kernel that enables an attacker who already has local access to the system to gain elevated privileges. By freeing a kernel object and later reusing the same memory reference, a malicious user can execute code with higher authority, potentially reaching SYSTEM or administrative rights. This flaw is classified as CWE‑416 and allows the compromised user to bypass security boundaries and access protected data or services.

Affected systems include Microsoft’s Windows 11 builds 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2025, including its Server Core installation. All of these releases are susceptible to the use‑after‑free flaw and require remediation.

The CVSS score of 7.8 indicates a high severity vulnerability, though no EPSS data is currently available. The flaw requires a local adversary with authorized access and does not rely on network exploitation. It is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time. Nonetheless, the high CVSS rating combined with the possibility of a local privileged attacker warrants prompt mitigation. If an exploit becomes available, escalation to SYSTEM could lead to full compromise of the affected host.