The vulnerability is a use‑after‑free condition in the Desktop Window Manager component. A correctly authenticated local user can exploit the flaw to execute code with higher privileges, potentially gaining full control of the affected system. The weakness is classified as CWE‑416 and results in unauthorized privilege escalation but does not directly compromise remote systems or enable network‑borne attacks.

Affected editions include Microsoft Windows 10 version 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019, 2022, and 2025. All architectures listed in the CPE entries, such as x86, x64, and arm64, are impacted. If your environment runs any of these releases, it requires review for the missing patch.

The CVSS score of 7.8 indicates a high severity of this local privilege escalation. The EPSS score is not available, meaning there is no publicly reported exploitation probability data, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker must first achieve local execution or be an authenticated user on the machine; from there, a crafted payload could trigger the freed memory use and elevate privileges. The absence of a remote trigger limits the attack surface to local or compromised user sessions.