The vulnerability is a use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock. It allows an authorized local attacker to execute code with elevated privileges, potentially compromising confidentiality, integrity, and availability of the system. The flaw arises when the driver frees a memory object while it is still in use, giving the attacker a window to corrupt and control execution flow. The primary impact is the ability to gain administrative rights and perform privileged operations on the affected machine.

Affected systems include Microsoft Windows 11 23H2, 24H2, 25H2, 26H1, 22H3 and Windows Server 2022, 2025 and the 23H2 Server Core edition. All listed versions have the Ancillary Function Driver for WinSock compiled with a code path that can trigger the use‑after‑free. Users running any of these builds are at risk.

The CVSS score is 7.0, indicating medium to high severity. The EPSS score is less than 1 %, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need local, authorized access to the machine and sufficient privileges to load or control the driver, but no remote vector is described. The flaw is exploitable in the presence of a regular user account with the ability to trigger the vulnerable operation, making it a local privilege escalation risk.