The vulnerability is a use‑after‑free in Windows Ancillary Function Driver for WinSock that allows an authorized local attacker to elevate privileges. This flaw, identified as CWE‑416, can enable a user to gain higher system privileges, potentially allowing execution of arbitrary code or broader access to system resources.

Affected systems include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 22H3, 26H1), and Microsoft Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, 23H2). All listed editions are susceptible to the identified issue.

The CVSS v3.1 base score of 7 indicates a high‑severity flaw. Although EPSS information is unavailable and the vulnerability is not listed in CISA's KEV catalog, the local privilege escalation nature and use‑after‑free weakness make it an attractive target for attackers that have local or authorized access. Exploitation requires triggering a use‑after‑free event via the WinSock ancillary driver, which can be achieved by a legitimate local user or an attacker who has compromised a system with elevated rights.