A flaw in the virtio-win viosock.sys driver can be triggered by a low‑integrity process that sends a malicious IOCTL request to the VIOSockSelect function. The request causes an integer overflow that bypasses bounds checking, resulting in a heap‑based buffer overflow in the NonPagedPool kernel heap. An attacker could exploit this to execute arbitrary code in kernel mode, giving them full control of a Windows system and therefore enabling privilege escalation.

The vulnerability affects Windows systems that load the virtio-win viosock.sys driver. No specific driver version numbers are listed, so any machine running a version prior to the patched release contains the flaw. This includes virtual machines that rely on virtio networking with the viosock driver.

The CVSS score of 7.8 indicates a high impact vulnerability. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog, suggesting moderate but not high exploitation probability at present. Exploitation requires a low‑integrity process to issue the crafted IOCTL, so the attack vector is local. If leveraged successfully, the integer overflow could be used to overwrite kernel memory and execute arbitrary code, resulting in complete privilege escalation.