The vulnerability is a use‑after‑free in the Windows Desktop Window Manager (DWM) core library that can be triggered by an authorized local attacker. Exploiting the flaw allows the attacker to gain escalated privileges on the affected Windows system, potentially enabling full system compromise, installation of malicious software, or execution of arbitrary commands. The weakness is identified as CWE‑416, indicating an improper management of freed memory that may lead to unintended behavior.

Affected systems are Microsoft Windows 11 variants 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2025 and its Server Core installation. These include the specified 64‑bit and ARM64 builds listed in the CNA vendor product information.

The CVSS score of 7.0 rates the vulnerability as high severity. The EPSS score is unavailable, so the exploitation likelihood cannot be quantified based on that metric. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local authorization to use the flaw; the likely vector is an authenticated local user exploiting a memory corruption in a privileged component. If a local user with moderate privileges is able to trigger the use‑after‑free, they could elevate to full system rights.