Use after free in the Windows StateRepository API allows an authorized attacker who has local access to the system to elevate privileges. The flaw occurs when the API mistakenly uses a memory reference after it has been freed, enabling an attacker to manipulate the execution context. This leads to unauthorized execution with higher privileges than the attacker originally possessed, potentially compromising system integrity and confidentiality.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1, and 26H2 (arm64); Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). The affected builds include x86, x64, and ARM64 architectures as listed by the Microsoft CNA.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. No EPSS score is provided, so current exploitation probability is unknown, but the exploitation requires local or privileged execution. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploit at the time of reporting. The attack vector is inferred to be local and authorized, meaning an attacker must already have a foothold or user-level access to the device. To exploit, the attacker would invoke the vulnerable StateRepository API function, trigger a use‑after‑free, and then gain elevated rights. Remediation is through applying the Microsoft security update released for this CVE.