The vulnerability is a use‑after‑free flaw in the Windows Ancillary Function Driver for Winsock. When an attacker forces the driver to reference memory that has already been freed, the kernel can execute code in the attacker's context. This flaw is identified as CWE‑416 and allows an authenticated local user to gain elevated privileges on the affected system.

Microsoft Windows 10 build 1607, 1809, 21H2, 22H2, and Windows 11 builds 23H2, 24H2, 25H2, 22H3, and 26H1 are affected. All versions of Windows Server from 2012 through 2025, including both standard and Server Core installations on x86, x64, and ARM64 architectures, also contain the vulnerable driver.

The CVSS base score of 7.0 indicates moderate to high risk. EPSS data is not available, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that no public exploits are currently known. Based on the description, it is inferred that the attacker must have local system access to manipulate socket operations, after which the use‑after‑free can be triggered. Successful exploitation would raise the attacker’s privileges to local administrative level, potentially enabling any further local attacks.