The flaw resides in the Windows Ancillary Function Driver for WinSock, where type confusion during resource access allows an authorized user to manipulate internal structures and elevate privileges locally. An authenticated user can invoke the driver in a manner that triggers the confusing type handling, thereby gaining higher privileges on the system. This is a local privilege escalation vulnerability identified as CWE-73.

This vulnerability impacts Microsoft Windows operating systems, including Windows 10 Version 21H2 and 22H2, Windows 11 Versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2022, Windows Server 2025, and the Windows Server 23H2 Edition (Server Core installation). The affected releases span x86, x64, and ARM64 architectures.

The CVSS score of 7.8 reflects a high severity risk. The EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring an authenticated user context; an attacker can trigger the flaw by interacting with the Ancillary Function Driver for WinSock through a process that loads the driver, thereby gaining higher privileges.