The vulnerability resides in the Windows Ancillary Function Driver for WinSock, where a use‑after‑free flaw allows an attacker who can already execute code in the user context to gain higher privileges. The flaw occurs when the driver frees a memory object that is still referenced. Successful exploitation elevates the attacker to a higher privilege level, potentially enabling full system compromise, including data modification, installation of malware, and persistence. The weakness corresponds to CWE‑416, an improper use of freed memory.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012 through 2025 including core installations. All these variants contain the Ancillary Function Driver for WinSock and are therefore susceptible to the described use‑after‑free. End users and administrators should refer to the Microsoft Update Guide for the specific package updates that address CVE‑2026‑70237.

The CVSS score is 7, indicating moderate to high severity. The EPSS score is not available, implying no available data on current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of immediate, widespread exploitation. Nonetheless, the privilege escalation is local and can be exploited by anyone who can run code on the affected system, which makes it a critical risk for environments with privileged user accounts or shared workstations.