Use after free in Windows Message Queuing Queue Manager allows an attacker with authorized local access to execute arbitrary code by corrupting memory and overwriting function pointers. This flaw enables the attacker to load malicious code into the service, potentially escalating privileges or compromising the entire system.

All listed Microsoft Windows releases are impacted, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server releases from 2012 to 2025. Both x86, x64, and ARM64 architectures mentioned by Microsoft are affected.

The CVSS score of 7.8 indicates a high severity vulnerability that requires an authorized local attacker; there is no remote exploitation vector. EPSS data is not available, so the current probability of exploitation cannot be quantified, but the flaw is not listed in the CISA KEV catalog, suggesting no known active exploits at the time. An attacker could use the flaw to inject malicious code into the Queue Manager service and potentially gain system-wide control.