Improper access control in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to perform local privilege escalation. The vulnerability can enable an attacker with basic local access rights to increase privileges, threatening the confidentiality, integrity, and availability of the affected system.

Microsoft Windows 10 version 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, 22H3, 26H1; Microsoft Windows Server 2012 (including core), 2012 R2, 2016, 2019, 2022 (including 23H2 core), 2025. All listed releases of these operating systems are affected.

The CVSS score of 7.8 indicates a high risk for affected machines. The EPSS score is below 1%, suggesting that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and an authorized user, making it most relevant to insider threats or locally installed malicious code. Proper patching eliminates the risk. The likely attack vector is a local user executing privileged code via the WinSock ancillary driver.