A race condition in the Windows Ancillary Function Driver for WinSock allows a local attacker to elevate their privileges. The improper synchronization of shared resources can lead to a scenario where an attacker can corrupt kernel memory or otherwise manipulate the driver’s execution flow, enabling them to gain higher privileges on the system. The vulnerability is rated as CVSS 7, indicating a high impact if successfully exploited.

Microsoft Windows operating systems are affected, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server releases such as 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Edition. These versions span both x86 and x64 architectures and include standard and Server Core installations.

The CVSS score of 7 indicates a significant risk, and the lack of an EPSS score or KEV listing suggests that exploitation is currently not widely observed. However, the vulnerability requires a locally authorized attacker, meaning an attacker who already has user-level access can gain elevated privileges. Because the flaw hinges on a race condition, exploitation may require precise timing and knowledge of driver behavior, which could limit its real-world usage. Nonetheless, the potential for privilege escalation warrants prompt attention.