A use-after-free flaw in Microsoft Windows Server 2025 kernel-mode drivers could allow an authenticated attacker to execute arbitrary code.

The vulnerability is a use-after-free (CWE-416) condition within kernel-mode drivers. Exploitation requires an authenticated user with low-level privileges (PR:L) and typically involves user interaction (UI:R).

The ability to execute code within the kernel-mode context poses a critical risk to organizational infrastructure. An attacker could potentially escalate privileges, steal sensitive data, or disrupt server operations. The CVSS score of 8.0 highlights the severe impact on confidentiality, integrity, and availability.

Immediate Action: Apply the latest Windows security patches provided by Microsoft to update the kernel-mode drivers to version 10.0.26100.32860 or later.

Proactive Monitoring: Review system event logs for unusual kernel crashes or unauthorized attempts to perform administrative tasks.

Compensating Controls: Restrict user access levels and implement endpoint detection and response (EDR) solutions to identify suspicious process behaviors originating from low-privilege accounts.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation, security teams should prioritize the deployment of the May 2026 patch cycle for all Windows Server 2025 instances. Immediate patching is the most effective way to eliminate this kernel-level risk.