Use after free vulnerability in the Windows Quality of Service (QoS) Packet Scheduler driver allows a local attacker who can execute code on the machine to gain elevated privileges. The flaw originates when the driver frees an object that is later accessed, enabling arbitrary code execution with SYSTEM rights. This escalation could permit the attacker to install malware, modify system configurations, or impersonate legitimate users, without requiring network access. The weakness is identified as CWE-416.

Affected operating systems include all listed Microsoft Windows 10 releases from 1607 through 22H2, Windows 11 releases 23H2 through 26H2, and Windows Server editions from 2012 up to 2025. Environments that run any of these versions and rely on the QoS Packet Scheduler driver are at risk. Systems lacking the corresponding update should be considered vulnerable until patched.

The CVSS score of 7.8 indicates a high‑severity local privilege escalation. Although no EPSS value is published and the vulnerability is not yet in the CISA KEV catalog, the use‑after‑free nature and reliance on local privileges make exploitation likely in environments where privileged users can run arbitrary code. Attackers would use local abandoned privileges; the condition requires a process context with existing rights to interact with the driver. Until a fix is applied, the risk remains significant.