An unauthorized use after free flaw in the Windows Ancillary Function Driver for WinSock allows a local user with authorized access to cause the driver to free an object and subsequently dereference that memory. This mismanagement of memory can be manipulated to run arbitrary code or modify system state with the privileges of the driver, thereby elevating the attacker’s effective privileges on the machine.

Microsoft Windows 10 builds 1607, 1809, 21H2 and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 22H3 and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025 and the 23H2 edition are all impacted. All listed editions remain vulnerable until Microsoft releases a security update for each affected build.

The CVSS score of 7 indicates high severity, while no EPSS score is currently published and the vulnerability is not included in the CISA KEV catalog. Exploitation requires local, authorized access and relies on the driver’s misuse of memory after a free operation. Although a local resident user can trigger the flaw, the potential for privilege escalation raises significant risk in environments where users possess limited but network‐related permissions. No publicly available exploit is reported at this time.