The vulnerability is a use‑after‑free condition in the Windows Ancillary Function Driver for WinSock. An authorized local attacker can trigger the defect to gain elevated privileges, potentially allowing execution with SYSTEM level authority. The flaw is a classic memory‑management error identified as CWE-416 and does not provide remote compromise or data exfiltration directly.

Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. All architectural variants (x86, x64, arm64) listed in the CPEs are vulnerable.

The CVSS score of 7.0 indicates a high severity local privilege escalation risk. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack requires a local, authenticated user, and the CVE description does not indicate a remote or arbitrary code execution vector. The overall risk is high, but any privileged user on a vulnerable system can potentially elevate permissions.