Use after free in the Windows USB Print Driver allows an authorized local attacker to elevate privileges. The flaw arises from a memory deallocation error that leaves a referenced memory region accessible, permitting malicious code to execute with higher privileges. This typical use‑after‑free (CWE‑416) can lead to local privilege escalation on any vulnerable Windows system, allowing attackers to gain administrative rights, modify system files, or install persistent malware without user interaction.

The vulnerability affects Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and the server editions Windows Server 2022 and Windows Server 2025 (including Server Core). All listed variants are impacted.

The CVSS score of 7 indicates high severity. An EPSS score of <1% suggests a very low probability of exploitation, although the flaw could still be leveraged. The vulnerability is not listed in the CISA KEV catalog. The exploit requires a local authorized attacker, most likely via a malicious USB printer or driver, and would trigger during normal printing operations to exploit the use‑after‑free.