A time‑of‑check time‑of‑use race condition in the Windows Ancillary Function Driver for WinSock allows an authorized user to elevate privileges locally. The flaw stems from a mismatch between validation and subsequent use of a resource, giving an attacker the ability to gain higher privileges and potentially compromise the entire system. The weakness is classified as CWE‑367.

Affected systems include a broad set of Microsoft Windows operating systems: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 22H3, 23H2, 24H2, 25H2; and a range of Windows Server releases – Server 2008 R2 SP1, Server 2008 SP2, Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022 (23H2 edition), and Server 2025. These include both standard desktop and server core installations.

With a CVSS score of 7.8 the flaw poses a high severity risk. The EPSS score of less than 1% indicates that, at present, there is a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authorized access and relies on a race between validation and use within the driver, meaning that systems with elevated local accounts are at greatest risk.