http://forumdzjegkm6ey6ngexwpv5u3f3sav5wnrwqmatcb6c6mhxmkhsczid.onion/topic/details/new-no-click-critical-vulnerability-in-microsoft-windows-cve-2025-21298/41
However, crucially, the pointer to this freed memory isn’t nullified. This creates what we call a vulnerability window – a period where we have a dangling pointer to freed memory. During this vulnerability window, if we can trigger a failure in UtReadOlePresStmHeader, the cleanup routine will attempt to free the same memory location again.