Use after free in the Windows Workstation Service enables a local, authenticated attacker to execute arbitrary code with elevated privileges. The flaw occurs when the service releases a memory buffer and an attacker can reallocate that buffer with malicious data before it is fully reclaimed, allowing code execution as the service process. According to CWE‑416, this leads to local privilege escalation and compromises confidentiality, integrity, and availability of the affected system.

Microsoft has listed the vulnerability as affecting a broad range of Windows operating systems. The impacted products include Windows 10 build 1607, 1809, 21H2, and 22H2; Windows 11 build 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 across both standard and Server‑Core installations. Versions are enumerated for both x86 and x64 platforms, noting ARM64 support for Windows 11 editions.

The CVSS Base score of 7.0 reflects a medium‑to‑high severity due to the requirement for local administrative or user access, yet the potential impact is significant. EPSS data is not available, so the probability of exploitation is currently unknown, but the flaw is not listed in the CISA KEV catalog. An attacker must already have local credentials; the vulnerability is likely to be leveraged by privileged users or malware that has obtained user‑level access, using a crafted payload to trigger the use‑after‑free bug and elevate privileges.