Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations). All affected systems are those identified under the CNA product list with respective release versions.

The CVSS score of 7 indicates a moderate to high risk, and while the EPSS score is <1%, indicating a low exploitation probability, the absence of KEV listing does not lower the urgency of patching. The vulnerability is exploitable only on systems where the driver is present and the attacker has local access; once exploited, the attacker achieves system-wide privileges. The likelihood of exploitation is uncertain, but the potential impact warrants prompt attention.