This vulnerability is a use‑after‑free flaw in the Windows Desktop Window Manager Core Library, classified as CWE‑416. An attacker who can execute code in an authorized session on a vulnerable system can cause the library to access memory that has already been freed, resulting in an elevation of privileges to local administrative rights. With those rights, the attacker can install or remove software, modify system configuration, or read and alter any data that requires elevated permissions, undermining confidentiality, integrity, and availability of the affected machine.

Microsoft Windows 10 versions 1809, 21H2, and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 (including their arm64 and x64 builds), and Microsoft Windows Server 2019, 2022, and 2025, including their Server Core installations, are impacted by this vulnerability.

The CVSS score of 7.0 places the flaw in the medium‑to‑high severity range. No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been documented yet. The likely attack vector is local, requiring the attacker to already have authorized access to the system, such as through a legitimate user account capable of running code, or by leveraging another locally executing process. Given the local nature and the need for authorized code execution, the overall risk is moderate, but patching is strongly advised.