The vulnerability is a use‑after‑free flaw in the Windows Ancillary Function Driver for Winsock. An attacker with local, authorized access can trigger the driver to read freed memory and exfiltrate arbitrary data stored there, resulting in the disclosure of sensitive information. The weakness is a classic race condition followed by a use‑after‑free, which under the circumstances can leak memory contents without requiring higher privileges.

Affected systems include several Microsoft Windows releases. On Windows 10, versions 1607, 1809, 21H2 and 22H2 are impacted. On Windows 11, the 23H2, 24H2, 25H2, 26H2, 26H1, and the variant listed as 23H2 are also vulnerable. In addition, Windows Server editions 2012 (both core and full), 2012 R2 (core and full), 2016, 2019 (core and full), 2022, and 2025 (including core installations) are affected.

The CVSS v3.1 score for this flaw is 4.7, indicating moderate risk. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires local, authorized access and leverages a race condition with use‑after‑free, an attacker would need to run code on the target machine and have sufficient privileges to trigger the vulnerable driver. The overall exploitation likelihood is thus limited to local users or malware already present on the machine.