The vulnerability involves a use‑after‑free flaw in the Windows Embedded Mode Service, which, when triggered by a locally authorized attacker, allows that attacker to gain elevated privileges on the affected system. This elevation can compromise the integrity of the operating system and enable the attacker to execute arbitrary code, modify system configuration, or install persistent malware. The weakness is characterized by CWE‑416.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2016, 2019, 2022, and 2025 (both standard and Server Core). The vulnerability is present across x86, x64, and ARM64 architectures as listed in the associated CPEs.

The CVSS score of 7.0 indicates a moderate to high severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation. The attack requires local access by a user who already has some level of privileges, and it is not listed in CISA's KEV catalog. An attacker would need to trigger the use‑after‑free condition within the Embedded Mode Service to achieve privilege escalation, making local privilege escalation the primary threat vector.