This vulnerability is a type confusion flaw in the Windows Ancillary Function Driver for WinSock. An attacker who can already run code on the system with some level of user privileges can exploit the mismatch between expected and supplied data types, causing the driver to operate with elevated privileges. The result is a local privilege escalation that can allow the attacker to run processes with SYSTEM rights, modify system configuration, install malware or otherwise compromise the integrity of the machine. The weak point is a type mismatch error, identified as CWE‑843.

Affected products include multiple Microsoft Windows operating systems. The flaw is present in Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Core installation variants and the specialized ARM64 builds where applicable. All configured installations of the Ancillary Function Driver for WinSock are potentially impacted.

The CVSS base score is 7.8, indicating a high severity. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog, suggesting limited public exploitation evidence to date. The exploitation vector is local, requiring the attacker to already have authenticated or authorized access to the target machine. Because the flaw uses a type confusion in a privileged driver, an attacker can elevate privileges to SYSTEM. As such, the risk is significant for organizations that allow non‑privileged users to run arbitrary code or have weak host‑based controls. Affected systems are recommended to be patched as soon as updates are available, and temporary mitigations such as restricting user privileges and disabling the driver would reduce the potential impact.