The vulnerability is a use‑after‑free flaw in the Windows Storage Spaces Controller that permits an attacker with local authorized privileges to execute arbitrary code with elevated rights. Classified as CWE‑416, the flaw allows a privileged user to raise their own privileges to a higher level, potentially compromising the entire system.

Microsoft Windows 11 versions 24H2, 25H2, 26H1, and 26H2 for ARM64 builds, and Windows Server 2025 in both full and Server Core installations are affected.

The CVSS score of 7.8 indicates moderate to high severity, and the EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires local authorized access, the attack vector is local; an attacker must already be able to run code with sufficient permissions to trigger the use‑after‑free and then obtain elevated rights.