A use‑after‑free flaw resides in the Windows Graphics Kernel, allowing an attacker who has local authorization to gain escalated privileges. The vulnerability is a classic memory corruption flaw (CWE‑416) that can lead to arbitrary code execution with elevated rights, compromising the confidentiality, integrity, and availability of the affected system.

Microsoft Windows operating systems are impacted, including Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H2, Windows 11 26H1, and Windows Server 2025 (including Server Core installations). The affected builds span both x86 and arm64 architectures.

The CVSS score of 8.8 indicates a high‑severity local privilege escalation risk. EPSS data is not available, so the likelihood of exploitation cannot be precisely quantified, but the vulnerability is not listed in the CISA KEV catalog. Attackers require local authorization and must be able to trigger the graphics subsystem to reach the use‑after‑free condition. Once triggered, the flaw can elevate the attacker’s privileges to system level.