This vulnerability stems from a use‑after‑free condition inside the Windows Update service. The flaw can be triggered when an authorized attacker manipulates an update package, allowing the service to access memory that has already been freed. Because the Windows Update process runs with system‑level privileges, a successful exploitation would give the attacker full administrative rights on the affected machine, undermining confidentiality, integrity, and availability.

Affected systems include Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2022 and 2025 (Server Core). The issue is present across ARM64, x86, and x64 architectures as indicated by the CPE details.

The CVSS score of 7 denotes high severity. The EPSS score of 0.00252 reflects a very low but non‑zero probability of exploitation in the wild. Because the vulnerability is not listed in CISA KEV, publicly known exploits have not yet been seen. The attack vector is local; an adversary must have the ability to influence the Windows Update process or provide a crafted update package. If they can trigger the use‑after‑free, they can elevate to system privileges.