A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock permits an authorized local attacker to gain higher privileges than they originally possessed. The vulnerability is rooted in improper memory handling identified as CWE‑122. By exploiting the dangling reference, the attacker can execute privileged code paths within the kernel, potentially enabling full control of the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (both full and Server Core installations). The CVE applies to all corresponding 32‑bit, 64‑bit, ARM64, and x86 build variants as listed by Microsoft.

The CVSS score of 7.8 indicates a medium‑to‑high severity. EPSS is currently unavailable, and the vulnerability is not catalogued in CISA’s KEV list. The feasible attack requires local, authorized access; an attacker would need to be able to run code with user privileges, after which the bug enables escalation to system‑level rights. No public exploits are reported, but the use‑after‑free nature makes this a potentially serious local privilege escalation vector.