The flaw is a type‑confusion vulnerability in the Windows Ancillary Function Driver for WinSock. An attacker who is already authenticated on the machine can cause the driver to treat an object as a different type, allowing the attacker to perform privileged operations that they normally could not. The weakness is catalogued as CWE‑362 (Race Condition) and CWE‑416 (Use‑After‑Free), indicating that concurrent access and memory management issues enable the type confusion. The result is a local privilege escalation that raises the attacker’s privileges to those of the operating system kernel.

Microsoft Windows 10 version 1607, 1809, 21H2 and 22H2; Windows 11 version 23H2, 24H2, 25H2 and 26H1; and Windows Server 2016, 2019, 2022, 2025 and the 23H2 edition, including their Server Core installations.

The CVSS score of 7 indicates a high‑severity local privilege escalation. The EPSS score is listed as < 1 %, implying a very low probability of exploitation under current circumstances. The vulnerability is not in CISA’s KEV catalog. Exploitation requires local user authentication and does not rely on remote or network vectors, so it can only be abused by an individual who has direct access to the affected machine.