The vulnerability is a use‑after‑free flaw in the Windows Common Log File System Driver. An attacker with local authorization can trigger the bug to execute code in the context of the SYSTEM account, allowing them to read, modify, or delete privileged data and compromise system integrity. The flaw is recognized as a CWE‑416 Use After Free weakness. Based on the description, it is inferred that a successful payload requires the user’s presence or activation of a specific process to trigger the use‑after‑free.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025. The vulnerability applies to both 32‑bit and 64‑bit builds, including ARM‑based Windows 11 systems, and affects server core installations where applicable.

The CVSS score of 7.0 classifies this as a medium‑severity local privilege escalation. Attackers must already have a local user account on the machine; there is no known remote access vector. The likely attack vector is local, inferred from the requirement for user presence to trigger the use‑after‑free. Because the flaw requires the exploitation of a freed memory reference, successful payload execution must be triggered in a user‑present environment. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that widespread exploitation is not currently documented. However, the medium severity and local scope suggest that organizations with unpatched systems should treat this as an actionable risk.