The vulnerability is a use‑after‑free in the Windows Universal Disk Format (UDFS) file system driver. An authorized local user can trigger the memory error to gain elevated privileges on the affected Windows system. The flaw is a classic Use‑After‑Free weakness (CWE‑416), and the official description states that it allows privilege escalation locally.

Affected Windows operating systems include several Windows 10 releases (1607, 1809, 21H2, 22H2), multiple Windows 11 builds (23H2, 24H2, 25H2, 26H2, 23H2, 26H1), and a broad range of Windows Server editions (2012, 2012 R2, 2016, 2019, 2022, 2025, with both full and Server Core installations). All versions running the default UDFS driver are susceptible.

The CVSS score of 7.8 indicates a high risk to confidentiality, integrity and availability for operators who can run code locally. No exploit probability (EPSS) value is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread, publicly available exploits. An attacker with local or administrative access could exploit the driver to obtain elevated rights, potentially compromising the entire system.