The flaw is a double free condition in the Connected Devices Platform Service (Cdpsvc) that allows an authorized local attacker to elevate privileges. This issue is classified as CWE‑415, which indicates that an object is freed twice, leading to memory corruption and potentially arbitrary code execution. The CVE description states that an authorized attacker can trigger the double free in Cdpsvc to become system‑level locally.

Affected products include Microsoft Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2025, including server‑core installations. These versions are listed by Microsoft’s CNA and are enumerated in the CPE strings for the 23H2 to 26H2 builds and the 2025 server.

The CVSS score of 7.0 indicates a moderate to high severity for local privilege escalation, with an EPSS score not available. The vulnerability is not listed in CISA’s KEV catalog. The impact is limited to systems where Cdpsvc is running and where the user has local authorized privileges. The attacker would need to be able to execute code in Cdpsvc to trigger the double free; thus the attack is possible only from a trusted local user context.