The vulnerability is a use‑after‑free condition in the Windows Ancillary Function Driver for WinSock. An attacker who can run code with user privileges can trigger the flaw and cause the driver to execute code with elevated rights. The flaw can let a local user gain higher‑privilege access, enabling installation of malware, modification of system settings, or other privileged actions. It corresponds to a classic memory‑management weakness mapped to CWE‑416.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 23H2 (including core installations). All affected releases use the same ancillary driver module that contains the faulty use‑after‑free code.

The CVSS v3.1 score is 7.0, indicating high severity for a local privilege‑escalation flaw. The EPSS score is not published, so the exact likelihood of exploitation is uncertain, but the flaw does not require network access and can be triggered by any application that runs as a user on the machine. The vulnerability is not in the CISA KEV catalog, suggesting no widespread weaponized exploits yet. An attacker with local access could therefore exploit the flaw to gain administrative rights, making the risk significant for systems that allow untrusted applications on the host.