This vulnerability is a use‑after‑free flaw in the Windows Search component that allows an authorized local attacker to gain elevated privileges. By triggering the flaw, an attacker can execute arbitrary code with system‑level rights, compromising integrity and potentially enabling later exploitation of other vulnerabilities.

The flaw affects a wide range of Windows releases. End‑users use Windows 10 versions 1607, 1809, 21H2, and 22H2. Windows 11 users on versions 23H2, 24H2, 25H2, 26H2 and 26H1 are also impacted. Server editions that are affected include Windows Server 2012 R2 (both standard and Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, all in their default configurations.

With a CVSS score of 7.8 the flaw is considered high severity and the probability of exploitation is unknown due to no EPSS score. The flaw is not listed in the CISA KEV catalog, which suggests that no widespread exploitation has been observed yet. The attack vector is inferred to be local, requiring an authenticated user to trigger a malicious search request that exploits the use‑after‑free condition. Successful exploitation would grant the attacker full SYSTEM rights on the compromised machine.