The flaw is in the Windows Ancillary Function Driver for WinSock where concurrent use of a shared resource lacks proper synchronization, creating a race condition that lets a local user trigger privileged actions. This allows an attacker with ordinary local privileges to elevate their permissions, potentially gaining administrative authority over the system.

Microsoft Windows 10 from version 1607 through 22H2, Windows 11 releases 23H2 to 26H1 (including 22H3 and 26H1), and Windows Server editions from 2012 to 2025—including all Server Core installations—are affected. The vulnerability spans 32‑bit, 64‑bit, and ARM64 architectures as indicated by the CPE entries.

The CVSS base score of 7.8 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the KEV catalog, suggesting no widespread exploitation yet. The attack requires local authentication and the ability to exploit the race condition in the driver; successful exploitation results in local privilege escalation.