What is the CVSS score of CVE-2026-20831?

CVE-2026-20831 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows AFD.sys are affected by CVE-2026-20831?

A local privilege escalation vulnerability in Windows Ancillary Function Driver (afd.sys) affects Windows 10, 11, and Server versions 2008-2025 across your entire Windows estate, enabling…. A patch is available.

How to fix or mitigate CVE-2026-20831?

Within 24 hours: Confirm patch availability from Microsoft and identify Windows systems with high-risk profiles (untrusted user access, privileged accounts, internet-facing). Within 7 days: Deploy patches to at least 50% of affected Windows endpoints and servers, prioritizing critical infrastructure and systems handling sensitive data. Within 30 days: Complete patch deployment across all Windows 10, 11, and Server systems (2008-2025), maintaining documented evidence of remediation status per system.

Windows AFD.sys CVE-2026-20831

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-01-13 secure@microsoft.com

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local low-privileged attacker (AV:L/PR:L) must win a narrow TOCTOU race (AC:H); success yields SYSTEM, giving full C/I/A on the same host (S:U).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 21:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 21:37 NVD

7.8 (HIGH) 7.0 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 18:16 nvd

HIGH 7.8

DescriptionNVD

Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authorized low-privileged user win a time-of-check-to-time-of-use race to elevate to SYSTEM across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 25H2, Server 2008 SP2 through Server 2025). Exploitation requires local code execution and reliably winning a narrow timing window, and no public exploit has been identified at time of analysis. EPSS is very low (0.03%, 6th percentile) and the CVE is not in CISA KEV, indicating no evidence of active exploitation.

Technical ContextAI

The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode transport component that backs the user-mode Winsock API, mediating socket operations for essentially every network-using process on Windows; because it is reachable from unprivileged user context and runs in kernel space, it is a recurring local-privilege-escalation target. This issue is a CWE-367 time-of-check-time-of-use race condition: the driver validates a resource or buffer state and then acts on it, but an attacker running a concurrent thread can mutate that state in the interval between the check and the use, causing the kernel to operate on attacker-controlled or inconsistent data. The CPE set confirms the flaw is in the OS kernel component (cpe:2.3:o:microsoft:...) rather than an application, spanning x86 and x64 Windows 10/11 and Windows Server builds.

RemediationAI

Apply the Microsoft security update for the affected build; a patch is available from the vendor and the fixed KB numbers per Windows release are listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20831 (exact patched version was not provided in the input and should be taken from that advisory for your specific build). No official workaround is documented; because exploitation requires local code execution as an authenticated user, the most effective compensating control until patching is to limit who can run code on affected hosts - enforce least privilege, restrict interactive and remote logon rights, and apply application allowlisting (e.g. WDAC/AppLocker) to block untrusted binaries, accepting the operational overhead of maintaining allowlists. These controls reduce, but do not eliminate, the local attack surface, so patching remains the primary fix.