A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock allows a local, authorized user to execute code with elevated privileges. The flaw arises from a race condition that can be triggered by manipulating driver operations, leading to privilege escalation and potential full system compromise. This vulnerability is a classic example of race‑condition exploitation and results in an attacker gaining the ability to run arbitrary code or undertake administrative actions.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations). All affected systems are those identified under the CNA product list with respective release versions.

The CVSS score of 7 indicates a moderate to high risk, and while the EPSS score is <1%, indicating a low exploitation probability, the absence of KEV listing does not lower the urgency of patching. The vulnerability is exploitable only on systems where the driver is present and the attacker has local access; however, once exploited, the attacker achieves system‑wide privileges. The likelihood of exploitation is uncertain, but the potential impact warrants prompt attention.