An authorized local user can trigger a use‑after‑free bug in the Windows Universal Disk Format (UDFS) file system driver. The flaw lets the attacker access freed memory and leverage it to modify kernel‑mode data structures, allowing a privilege escalation. The vulnerability is identified as CWE‑416. If successfully exploited an attacker can gain higher privileges on the affected system, effectively turning a limited user into a local administrator or SYSTEM‑level process.

Microsoft Windows operating systems from Windows 10 version 1607 through 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, are affected. All Windows Server releases from 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core configurations, are also vulnerable. The issue is present in UDFS drivers on both x86 and x64 platforms and, for Windows 11, on ARM64 systems.

The CVSS score of 7.8 indicates high severity with moderate privileges. EPSS data is not available, so the probability of exploitation is unknown, but the vulnerability is a local privilege escalation that requires an authorized attacker who can invoke the UDFS driver, such as through removable media or driver loading. Microsoft has not listed it in the CISA KEV catalog, so no known exploits have been publicly documented yet, but the presence of a local use‑after‑free means that once a patch is released, defenders should apply it immediately and monitor for related anomalous memory accesses.