This vulnerability is a double‑free flaw in the Windows Ancillary Function Driver for WinSock, allowing a local authenticated attacker to elevate privileges by corrupting kernel memory. When the driver frees a memory block twice, it can overwrite critical kernel structures, potentially enabling the attacker to execute code with system rights. The weakness is classified as CWE‑415.

Affected products include Microsoft Windows 10 desktop releases from version 1607 through 22H2, Windows 11 releases from 23H2 through 26H2, and Windows Server editions from 2012 to 2025, covering both x86 and x64 architectures where listed, with ARM64 support in newer Windows 11 editions.

The flaw scores a CVSS base score of 7, indicating high risk, but the EPSS is not available and the vulnerability is not yet in the CISA KEV catalog. Exploitation requires local authenticated access; an attacker can trigger the double free by interacting with the WinSock ancillary function driver, potentially allowing code execution with system-level privileges. The attack vector is local, requiring the attacker to be able to engage the driver on the target system.