The vulnerability is a use‑after‑free flaw in the Windows TCP/IP stack that allows a local attacker to elevate privileges. By exploiting the bug, the attacker can gain higher level rights, potentially leading to full system control. The weakness is identified as CWE-416, which relates to undefined behavior during memory deallocation.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS base score is 7.0, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, meaning it has no confirmed public exploits yet. The likely attack vector is local: an authorized user or malicious process needs to exercise control over a TCP socket to trigger the use‑after‑free. Once triggered, the attacker can obtain System privileges. Because the fix is a kernel‑level patch, early deployment is recommended to reduce the attack window.