The vulnerability is a use‑after‑free bug in the Windows kernel that allows an authorized attacker with local access to elevate privileges. An attacker who can trigger the flaw can gain higher system privileges, enabling them to operate with kernel‑level authority.

Microsoft Windows 11 24H2, Windows 11 25H2, Windows 11 26H2, Windows 11 26H1, and Windows Server 2025 (including Core installations) are affected. The issue impacts both x64 and arm64 architectures, covering a broad range of Windows 11 and Server 2025 builds.

The CVSS score of 7 indicates a high severity impact when the flaw is successfully abused. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is purely local; therefore, the attacker must have some form of local access, such as a logged‑in user with sufficient privileges, to trigger the use‑after‑free. Exploitation would result in the attacker gaining elevated system privileges.