Use after free in the Windows Storage VSP Driver permits an authorized user to achieve local privilege escalation. The flaw allows the attacker to access freed memory, potentially leading to arbitrary code execution or elevation of privileges. This vulnerability is classified as CWE‑416 and carries a CVSS score of 7.8, indicating a high risk for systems when exploited locally.

The vulnerability affects numerous Microsoft Windows platforms. Specifically, Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2016, 2019, 2022, and 2025, including both full and Server Core installations. All affected systems deploy the Windows Storage VSP Driver component susceptible to the use‑after‑free condition.

With a CVSS score of 7.8 the risk is significant, yet no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring an authenticated or otherwise authorized attacker who can manipulate the storage VSP Driver to trigger the freed memory access. Exploitation would need control over the driver interface, and the vulnerability does not allow for remote exploitation. Prompt patching remains the recommended defensive posture.