The vulnerability is a use‑after‑free flaw in the Windows USB Print Driver that allows an authorized local attacker to execute code as SYSTEM, potentially granting full control over the affected systems. Because the flaw is triggered from driver code, successful exploitation would bypass standard user‑level protections, giving the attacker higher privileges and the ability to modify system settings, install software, or exfiltrate data. This issue is a direct result of improper memory management in the driver, identified as CWE‑416.

Affected systems include Microsoft Windows 10 releases 21H2 and 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core installations). All variants of these operating systems that retain the default USB print driver configuration are vulnerable.

The CVSS score of 7.0 categorizes this vulnerability as medium severity. The EPSS score is not available, indicating either a lack of publicly measured exploit prevalence or insufficient data at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been exploited in the wild. Because the flaw requires local execution and an authorized user context, the main attack vector is a local attacker with console access or an application that can trigger driver actions. If an attacker gains a local privileged user account, they can exploit the use‑after‑free to elevate privileges. There is no publicly disclosed, automated exploitation path known, and no publicly available exploit code is referenced.