The vulnerability is a use‑after‑free flaw in the Windows Server Message Block (SMB) server component. When triggered, an attacker with local or authorized access can obtain elevated privileges on the affected system. This gives an attacker the ability to read, modify, or delete sensitive data, install malware, and impersonate higher‑privileged accounts, thereby compromising confidentiality, integrity, and availability of the system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and the 23H2 release for arm64, as well as Microsoft Windows Server 2016 (including Server Core), Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The CVSS score of 7 indicates a high severity; however, the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is local or intranet‑based: an authorized or locally authenticated user can trigger the use‑after‑free condition. Given that the flaw requires an attacker to have access to the SMB service, it is less likely to be exploited remotely but presents a serious risk in environments where privileged or potentially compromised local accounts exist. Organizations should treat this as a high‑priority risk until the fix is installed.