A use‑after‑free flaw in the Windows Web Account Manager allows a local, authorized attacker to execute code with the privileges of the current user, potentially escalating to administrator level. The vulnerability arises after a memory object has been freed but a reference to it is still used, triggering arbitrary code execution when the flawed object is accessed.

Affected machines include Windows 10 running versions 1809, 21H2, and 22H2; Windows 11 running versions 23H2, 24H2, 25H2, 26H2 (including arm64 and x64 variants); and Windows Server 2019, 2022, and 2025, including Server Core installations. These versions are listed in the CNA vendor/product entries for the vulnerability.

The CVSS score of 7 indicates medium severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local and requires the attacker to have legitimate user access to the system. Once the use‑after‑free is triggered by the Web Account Manager, the attacker can execute code with the privileges of the current user, effectively elevating privileges on the local system.