Improper validation of a particular input type in the Windows Ancillary Function Driver for WinSock permits an attacker who already has local access to increase their privileges. The flaw is classified as CWE‑1287. If exploited, the attacker can execute actions with higher rights, enabling full compromise of confidentiality, integrity, and availability on the affected machine.

The issue affects Microsoft Windows 10 starting with version 1607 through 22H2, Windows 11 beginning with version 23H2 up to 26H1, and the Windows Server family including 2012, 2012 R2, 2016, 2019, 2022, and 2025 releases along with their core installations.

The severity assessment places the vulnerability at a high level with a rating of 7 on the standard scale, while current exploitation likelihood is reported as less than 1 %, indicating limited active use by threat actors. The flaw is not present in the known‑exploited vulnerabilities list. An attacker would need local, authorized access to send crafted input to the driver; success would elevate their rights, presenting a significant risk to the host's security posture.