The Windows kernel contains a use‑after‑free flaw that allows an authorized local user to elevate privileges by triggering unintended kernel operations, a classic memory‑corruption vulnerability (CWE‑416). The attacker can read, alter, or delete any data on the system, install malware, or perform further privileged actions once the flaw is exploited.

This flaw affects Windows 10 builds 1809, 21H2 and 22H2, Windows 11 builds 23H2, 24H2, 25H2, 26H2 and 26H1, and the Server family versions 2019, 2022 and 2025, including Server Core editions. Devices running any of these operating systems on x86, x64, or ARM64 architectures are vulnerable.

With a CVSS base score of 7.8 the vulnerability is considered high severity for local attackers and can fully compromise the affected machine. The attack vector requires local authorized access; exploitation is achieved via a use‑after‑free in kernel code that may be triggered by privileged system components or drivers. Although the EPSS score is not available and the CVE is not listed in the CISA KEV catalog, the high severity and local elevation capability call for rapid action as soon as a patch is released.