A use‑after‑free flaw in the Windows kernel lets a locally authenticated user execute code with elevated privileges. The flaw stems from an improper release of kernel‑mode objects (CWE‑416) combined with a missing check that an object had not been freed (CWE‑822). If exploited, the local attacker can gain full administrator rights, compromising all data, services, and system integrity.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019, 2022, 2025, including their core installations and ARM64‑based Windows 11 devices. All affected editions listed in the CNA product set are vulnerable.

With a CVSS score of 7 the vulnerability is considered high severity. Its EPSS score is currently unavailable, but the lack of a public exploit and its local‑only nature imply a lower exploitation probability. The issue is not listed in CISA’s KEV catalog. An attacker would need local, authorized access to the target machine; from there the flaw can be triggered by manipulating kernel objects through a crafted application or service. The exploit can be performed without user interaction once the attacker has local privileges.