The flaw is a race condition in the Windows TCP/IP stack. Concurrent execution of code that shares a resource without proper synchronization permits an attacker who already has authorized local access to raise their privilege level. This can enable the user to obtain full system rights, potentially gaining SYS‑V authority. The weakness is categorized as a concurrent execution race condition (CWE-362).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Server edition. All listed editions, whether standard, core, or arm64, are affected due solely to the kernel‑level TCP/IP component.

The vulnerability carries a CVSS score of 7.8 and is not listed in the CISA KEV catalog. EPSS data is unavailable, so the precise exploitation probability remains unknown. The attack vector is local; an adversary must be authenticated on the host and able to trigger concurrent TCP/IP operations. Though no remote exploit is reported, the high severity and local privilege escalation potential make the risk significant for environments that permit broad local access.