A race condition combined with a use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock enables an authorized local user to execute code with higher privileges. The vulnerability arises when the driver frees a memory buffer that it continues to reference, allowing the attacker to manipulate control flow after the kernel believes the object is no longer valid. The primary impact is privilege escalation, granting the attacker elevated rights and potentially full system compromise on the affected machine.

The flaw applies to Microsoft Windows 10 releases 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, in both full and core installations. All supported architectures—x86, x64, and arm64—are affected.

The CVSS score of 7 signifies a medium severity assessment. The attack vector is local and requires an authenticated user or physical access; no public exploit is known, and the EPSS score is not available, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attacks would need to be performed from a user account with local privileges on the target system.