A use‑after‑free flaw in the Windows Clipboard User Service enables an attacker who already has local authorization to gain higher privileges, potentially moving from a standard user to an administrator within the same system. The flaw arises when the service attempts to reference memory that has already been released, allowing arbitrary code to run with elevated rights. This is specifically a CWE‑416 weakness, typical of memory‑management bugs that can be exploited to hijack control flow.

The vulnerability impacts a broad range of Microsoft Windows operating systems, including Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, 23H2 (Arm64), and 26H1 (x86); as well as Windows Server editions 2016, 2019, 2022, and 2025, in both full and Server Core installations. All affected platforms are listed by Microsoft and are identified by the associated CPEs.

The CVSS score of 7.8 indicates a high severity and the available EPSS score of 0.00242 (0.24%) indicates a very low exploitation probability, but the CVE is not listed in CISA’s KEV catalog. Consequently, the risk remains moderate to high for organizations that have not applied the available Microsoft updates. Because the flaw requires a local attacker with some level of system access, the most likely attack vector is local execution; however, any process that can influence the clipboard content could serve as a vector, making it vital to handle privileged code carefully.