The vulnerability is a use‑after‑free flaw in the Windows Cloud Files Mini Filter Driver that permits an attacker with legitimate local access to execute arbitrary code with elevated privileges. This defect is classified as concurrent modification (CWE‑362) and memory corruption (CWE‑416). Successful exploitation can grant the attacker full system control, allowing them to modify protected files, install malware, or pivot to remote systems.

Microsoft Windows 10 (versions 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), Microsoft Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The CVSS score of 7 indicates a medium‑to‑high severity. With an EPSS score of less than 1 % and no listing in the CISA KEV catalog, the known exploitation probability is low. However, the flaw requires only local authorized access, making it viable for attackers who already have physical or login access to a machine. Successful exploitation leads to increased privileges and potential system compromise.