The vulnerability is a classic use‑after‑free flaw in the Windows TCP/IP networking code, classified as CWE-416. When triggered by an authorized local attacker, the flaw allows the attacker to acquire elevated local privileges, potentially enabling full control over the affected system.

Microsoft Windows 10 versions 1607 through 22H2, Windows 11 releases 23H2 to 26H2, and all Windows Server editions from Server 2012 up to Server 2025 are impacted.

The CVSS score of 7 indicates moderate‑to‑high severity, while the EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability requires local, authorized access and is not a remote exploit, but once locally exploited it can lead to full system compromise. The vulnerability is not currently listed in the CISA KEV catalog. The expected attack vector involves a legitimate user interacting with a network service that triggers the use‑after‑free condition, after which the attacker can elevate privileges.