The vulnerability is a use‑after‑free error in the Windows Ancillary Function Driver for WinSock that allows an attacker who already has local system access to elevate their privileges. The flaw is a classic memory‑corruption issue classified as CWE‑416. If successfully exploited, the attacker can gain higher privileges on the affected machine, potentially compromising all local resources and services.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations).

The CVSS score of 7.0 indicates a high severity for local attackers. The EPSS score is not available, but the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is local; an adversary must already compromise the target system to exploit this use‑after‑free and raise privileges. Given the moderate‑to‑high CVSS and the local nature, the risk remains significant for environments that allow local users or services with elevated privileges.