The vulnerability is a use‑after‑free condition in the Windows Universal Disk Format (UDFS) file system driver. The flaw allows a security‑enabled local user to execute code or otherwise gain elevated privileges on the system. This weakness is classified as CWE‑416 and can lead to a local privilege escalation that compromises the confidentiality, integrity, and availability of the affected host.

Microsoft Windows client and server releases, including Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 releases from 23H2 through 26H2 (x86, x64 and arm64 architectures), as well as Windows Server 2012 through 2025, are affected. All listed builds run the vulnerable UDFS driver; users of these operating systems are at risk if the driver is loaded during normal system operation.

The CVSS score of 7.8 denotes a moderate‑to‑high severity, but the exploit probability is not quantified in the current data and the vulnerability is not listed in the CISA KEV catalog. An attacker must already have local access and sufficient privileges to mount or interact with UDFS volumes. No public exploit is known, yet the local elevation path is viable and could be used for subsequent attacks. Microsoft has released an update that resolves the use‑after‑free and provides the sole mitigation.