An attacker with local authorization can exploit a type confusion flaw in the Windows Ancillary Function Driver for WinSock, allowing unauthorized access to resources with a mismatched type. This vulnerability is classified as CWE‑843 and enables the attacker to gain higher privileges on the affected system, potentially leading to full control over the host. The impact is confined to the local user context, but the privilege level attained can allow installation of malware, modification of system files, or persistence mechanisms.

Microsoft Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 to 25H2, and several Windows Server editions from 2008 R2 and 2012 through 2025. The affected stack includes both x86 and x64 architectures, as well as ARM64 on newer Windows 11 releases.

The vulnerability carries a CVSS score of 7.8, indicating high severity, but the EPSS score is below 1%, showing a very low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog, so there is no evidence of widespread exploitation yet. The attack requires local user presence; therefore, environments that reduce local user privileges or enforce least privilege mitigations can lower the risk. The lack of a publicly documented exploit does not eliminate the risk, as malicious actors can craft exploits for type‑confusion bugs.