The flaw is a use after free bug within the Windows TCP/IP stack that allows a local attacker who has some authorized access to increase their privileges. The vulnerability is a classic example of memory corruption that can lead to arbitrary code execution or privilege escalation. It is specifically tied to integer overflow or wraparound conditions (CWE-190) and invalid memory access after an object is freed (CWE-416).

This vulnerability affects a broad range of Microsoft Windows operating systems, including Windows 10 for versions 1607, 1809, 21H2 and 22H2; Windows 11 for versions 24H2, 25H2 and 26H1; as well as Windows Server from 2012 through 2025, in both standard and Server Core installations.

The CVSS score of 7.8 indicates a high severity concern, but the EPSS score of less than 1% signals a very low probability of exploitation in the wild as of the last update. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active exploitation. The likely attack path requires the attacker to be able to run code on the target system or send crafted network traffic from a local network, so the scope is restricted to local privilege escalation rather than remote attacks.