An authorized attacker who can already run code on a Windows system can trigger a use‑after‑free flaw in the USB Print Driver. This failure in memory handling allows the attacker to gain higher privileges, potentially moving from a standard user to an administrator or system account. The vulnerability is a classic use‑after‑free problem (CWE‑416) that can corrupt the driver’s control flow once freed memory is reused.

The flaw affects Microsoft Windows 10 version 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, and Windows Server 2022 and Server 2025 (including Server Core). All listed builds with x86, x64 or arm64 processor architectures are vulnerable.

The CVSS score of 7.0 indicates moderate to high severity, though no EPSS data is publicly reported and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or authenticated access, making it a concern for users who have the ability to add or manage USB printers. An attacker could abuse the flaw to elevate privileges on a compromised workstation or server without needing network access.