Windows Ancillary Function Driver for WinSock contains a type‑confusion vulnerability (CWE‑843) that allows an authorized local user to read memory as an incorrect type, resulting in uncontrolled privilege elevation. The flaw permits the attacker to execute code with elevated rights, potentially compromising system confidentiality, integrity, or availability across the affected machine. Because the vulnerability is triggered by local interaction, it cannot be exploited remotely without already having an authenticated session on the target.

Impact is limited to Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server products 2012, 2012 R2, 2016, 2019, 2022, and 2025, including core installations. Systems running the Ancillary Function Driver for WinSock in these affected versions are vulnerable until a Microsoft patch is applied.

The CVSS score of 7.8 indicates a high risk profile, while the absence of an EPSS value means the exploitation probability is unknown from this source. The vulnerability is not present in the CISA KEV catalog, but because it requires local privilege, an attacker with an authorized account or physical access can readily leverage the flaw if a patch is not applied. The exploit surface is narrow as it depends on the specific driver bug, but the potential impact is significant for compromised machines.