A use‑after‑free condition in the Windows Ancillary Function Driver for WinSock, classified as CWE‑416, permits an attacker with local authorized access to gain elevated privileges. The flaw allows the transition from a normal user context to one with higher authority on the affected system. No remote code execution or denial of service is suggested explicitly by the description, and the vulnerability requires local interaction with the driver.

The vulnerability affects a wide range of Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1, and the corresponding Windows Server editions: 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2. Both standard and Server Core installations are listed among the affected platforms as indicated by the advisory.

The CVSS score of 7.0 signifies medium severity. EPSS data is currently unavailable, and there is no entry in the CISA KEV catalog for this flaw. The exploitation path is local and requires an attacker to be already authorized, but once the use‑after‑free is triggered, the attacker can raise their privileges on the compromised machine. The likely attack vector is a local privileged action executed against the driver, and the vulnerability can be mitigated by applying the vendor's update.