The vulnerability is a heap‐based buffer overflow in the Windows Ancillary Function Driver for WinSock that allows an attacker with local access to elevate privileges. This relates to CWE‑122 (heap overflow) and CWE‑787 (out‑of‑bounds write) and can enable a user to gain higher privileges on the affected machine, potentially compromising confidentiality, integrity, or availability of the system.

Affected operating systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, 22H3, and 26H1; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Edition. The affected builds cover x86, x64, and arm64 architectures, including Core installations where applicable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% suggests a low probability of widespread exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker must already have some level of local access to load or interact with the driver. Once exploited, the attacker can raise privileges on the target system, potentially enabling further attacks or persistence.