An authorized local attacker can exploit a type confusion flaw in the Windows Ancillary Function Driver for WinSock, allowing the attacker to elevate privileges and gain higher access rights on the system. The vulnerability stems from accessing a resource using an incompatible data type, which is a classic type‑confusion error (CWE‑843). The result is that an attacker could execute malicious code with elevated privileges, modify system files or registry settings, and potentially install persistence mechanisms.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1 (including ARM64 and x64 builds); Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both Server Core and full installations). These products are listed in the CNA impacted‑product list and include both x86 and x64 architectures.

The vulnerability has a CVSS score of 7, indicating moderate severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. The attack vector is local and requires the attacker to be authorized on the target machine. Despite its moderate score, the flaw allows an attacker to gain elevated local privileges, so it is considered a significant risk if unpatched. Given its local nature, exploiting it requires user interaction or existing local access, but once achieved, the impact is broad and severe.