A use‑after‑free flaw in Windows Management Services permits an authorized local user to execute privileged operations. The vulnerability arises when memory is freed and later improperly reused, allowing the attacker to perform actions with elevated rights. This can lead to the modification of system settings, the execution of injected code, or other malicious actions that require higher privileges than the user initially possesses.

Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2025 including Server Core installations are affected. The flaw exists on both x64 and arm64 architectures for these Windows 11 editions.

The CVSS score of 7.8 indicates a high severity local privilege escalation. No EPSS score is currently available, so the exact exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have authenticated local access to trigger the use‑after‑free path, but the flaw resides in a core system service, eliminating the need for remote network exposure. Because the issue results from improper memory handling (CWE‑416), the primary countermeasure is to apply the vendor patch that addresses the flaw.