The vulnerability is a use‑after‑free flaw in Windows Direct Composition that allows an authorized attacker to elevate privileges locally. Based on the description, it is inferred that the flaw could permit arbitrary code execution with higher rights.

Affected systems include Microsoft Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Versions 23H2, 24H2, 25H2, 26H2, Windows 11 version 26H1, and Windows Server 2022 and Server 2025 (including Server Core installations). The vulnerability was identified through Microsoft’s Common Platform Enumeration identifiers for these editions and architectures.

The CVSS score of 7.8 indicates a high severity for a local privilege escalation scenario. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred that the likely attack vector involves a locally compromised or malicious application that exploits the Direct Composition use‑after‑free condition to run code with elevated privileges. If exploited, it is inferred that an attacker could install malware, modify system settings, or pivot to higher‑privileged accounts.