A use‑after‑free flaw in Windows Print Spooler components allows an authorized local user to elevate privileges. Classified as CWE‑416, the vulnerability provides a direct path for the attacker to assume administrative rights on the affected system without requiring remote code execution or network access. The impact is local but can lead to full system compromise once higher privileges are obtained.

Affected operating systems include Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H2 (including arm64 variants), and Windows Server editions 2012 through 2025. All release channels, including Server Core, are impacted across x86, x64, and arm64 architectures. Any build in these ranges that has not received the cumulative update that addresses the Print Spooler component is considered vulnerable.

The CVSS score of 7.8 indicates high severity. No EPSS score is available, so the current likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at this time. Because the attack vector requires an authorized local user, the flaw presents a high risk if privileged accounts exist, as it can be triggered without remote interaction and provides direct administrative privileges.