A use‑after‑free flaw in the Windows Win32 Kernel Subsystem allows a local attacker to elevate privileges. The vulnerability exploits a freed memory reference that an authorized attacker can manipulate to gain higher privilege levels without requiring initial compromise of a high‑privilege account. This results in a loss of integrity and control over the affected system.

Microsoft Windows 11 version 24H2, 25H2, 26H1, and 26H2, including ARM64 and x64 builds, as well as Microsoft Windows Server 2025, both standard and Server Core installations.

The CVSS score of 7.8 indicates a high severity of the flaw. No EPSS score is available, so the likelihood of exploitation is currently unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local: a user with some level of authorization or access to software that triggers the use‑after‑free must be able to interact with the implicated subsystem. Successful exploitation would let the attacker gain elevated privileges on that machine, potentially leading to full system takeover.