A use‑after‑free flaw in the Windows kernel allows an attacker who can run code with user‑level privileges to elevate privileges locally. The vulnerability is a classic memory safety error (CWE‑416) and can give the attacker the ability to execute code with kernel or elevated system rights, potentially compromising the entire system or gaining control over an organization’s network assets. The impact is purely local; an attacker must already have the ability to execute code on the target machine.

The flaw affects a broad range of Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 (both arm64 and x64), Windows 11 26H1, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. All of these variants are listed in the known affected CPE entries, covering both x86 and x64 architectures for desktop Windows and server core installations.

The CVSS score of 7.8 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so known exploitation activity is not documented at this time. The attack vector is inferred to be local, requiring that the attacker already be able to execute arbitrary code on the target. Because the flaw is a kernel use‑after‑free, successful exploitation can rapidly lead to full system compromise if the attacker already has a foothold on the machine.