A heap‑based buffer overflow exists in the Windows Ancillary Function Driver for WinSock, allowing an authorized attacker to elevate privileges locally. This flaw, classified as CWE‑122, occurs when a locally authenticated user overflows the driver’s heap buffer, enabling privilege escalation to system rights. The impact is confined to the local machine and requires the attacker to have local access or be logged in.

Microsoft Windows 10 version 1607, 1809, 21H2, 22H2; Windows 11 version 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations.

The CVSS score of 7.8 indicates medium‑to‑high severity, while the EPSS score of less than 1 % suggests a low likelihood of active exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must be authenticated locally, as no remote exploitation path is documented; from that position the heap overflow can be leveraged to execute code with elevated privileges.