The flaw resides in the Windows Ancillary Function Driver for WinSock, where external control of file names or paths can be exercised. An authenticated user can manipulate file handling within the driver, enabling them to obtain elevated privileges on the local machine. This is a local privilege escalation vulnerability classified under CWE‑73, which denotes external control of a file name or path.

This vulnerability impacts Microsoft Windows operating systems, including Windows 10 Version 21H2 and 22H2, Windows 11 Versions 22H3, 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2022, Windows Server 2025, and the Windows Server 23H2 Edition (Server Core installation). The affected releases span x86, x64, and ARM64 architectures.

The CVSS score of 7.8 reflects a high severity risk. EPSS information is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring an authenticated user context; an attacker can trigger the flaw by interacting with the Ancillary Function Driver for WinSock through a process that loads the driver, thereby gaining higher privileges.