A use‑after‑free flaw in the Windows internal user profile system exposes a local attacker to unauthorized privilege escalation. The flaw allows the attacker to run code with higher privileges after the victim’s user profile resources are freed, enabling the escalation of the attacker’s local credentials to administrator or system level. The weakness is identified as CWE‑416 and results directly in elevated access to the system without affecting confidentiality or integrity of unrelated data.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2016, 2016 Server Core, 2019, 2019 Server Core, 2022, and 2025, including the Server Core installations.

The CVSS score of 7.8 indicates high severity for local privilege escalation. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The likely attack vector is a local user with authorized access, since the flaw is triggered after the user profile is freed during user session processing. A compromised or malicious local user could exploit the flaw to elevate privileges and gain system level control.