A vulnerability in the Windows Ancillary Function Driver for WinSock allows an authenticated local attacker to elevate privileges, posing a significant risk to system security.

The flaw is an improper access control issue (CWE-284) within the Windows Ancillary Function Driver. It requires the attacker to already possess local access with low privileges to trigger the escalation.

Successful exploitation allows a local user to gain higher-level privileges on the host system, potentially leading to full system compromise. With a CVSS score of 7.8, this vulnerability is classified as High severity, as it facilitates unauthorized administrative control over affected endpoints.

Immediate Action: Apply the relevant security updates provided by Microsoft in the official security update guide to address the underlying access control flaw.

Proactive Monitoring: Review system logs for unusual process execution patterns or unexpected elevation requests by standard user accounts.

Compensating Controls: Ensure robust endpoint protection policies are in place to restrict unauthorized software execution and maintain the principle of least privilege for local users.

Public Exploit Available: No — exploit_available is unknown.

Given the potential for privilege escalation and full system compromise, IT administrators should prioritize the deployment of the vendor-supplied patches across all affected Windows environments. Organizations should verify that their patch management cycle includes these specific build updates to mitigate the risk of local exploitation.