The vulnerability is a use after free condition within the Windows Local Security Authority, which allows a local attacker who already has authorized access to elevate privileges on the affected systems. This flaw, identified as CWE‑416, could let the attacker gain higher local privileges, thereby compromising the confidentiality and integrity of the operating system and the data it protects.

Microsoft Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, as well as 23H2 and 26H1 on ARM64 and x64 platforms; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core variants) are all impacted. The vulnerability can affect both desktop and server editions of Windows when the Local Security Authority component is present.

The CVSS score of 7.0 classifies the issue as high severity, and the EPSS score of 0.00252 indicates a very low but non-zero probability of exploitation; the lack of a listing in the CISA KEV catalog suggests that widespread exploitation has not yet been observed. The flaw is typically local and requires the attacker to have some local presence on the machine; it can be exploited by an authorized user to gain elevated privileges, making it a serious local privilege‑escalation threat.