The flaw is a use‑after‑free in the Windows AppX Deployment Service that permits an attacker with authorized local access to gain higher privileges. An attacker can free a memory object and then read or write to it, executing arbitrary code at the privilege level of the service and elevating from a standard user to an administrator. The identified weakness is CWE‑416 and can compromise confidentiality, integrity, and availability of the affected system.

Microsoft Windows 10 releases 1809, 21H2, and 22H2; Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The CVSS score of 7.0 denotes high severity; no EPSS data is available and the vulnerability is not listed in CISA KEV. The attack vector is local, requiring authenticated or legitimate user privileges to trigger the use‑after‑free. Once exploited, the attacker can execute code with elevated rights on the host, potentially compromising all local resources and services.