Use‑after‑free in the Windows Ancillary Function Driver for WinSock allows a local attacker with authorization to gain higher privileges. The flaw occurs when the driver deallocates memory that remains referenced, enabling the attacker to manipulate kernel data structures to elevate privilege. This can compromise confidentiality, integrity and availability of the affected system by permitting the attacker to run code with elevated rights.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 7 indicates a medium severity flaw, and the EPSS score of 9% indicates a moderate exploitation probability. The vulnerability is listed in the CISA KEV catalog, indicating that known or suspected exploits have occurred in the wild. Exploitation requires a local authorized user who can trigger the WinSock driver to trigger the use‑after‑free condition in the Ancillary Function Driver and elevate privileges. The flaw is a classic use‑after‑free (CWE‑416) that allows an attacker to gain higher privileges, potentially compromising confidentiality, integrity, and availability of the affected system.