Windows AFD.sys CVE-2026-20831

The attacker must already have local, authenticated access with low privileges (PR:L) and the ability to execute code on the target - this is a post-compromise escalation, not a remote entry point. Exploitation further depends on reliably winning the time-of-check-to-time-of-use race in afd.sys, which the CVSS AC:H rating flags as a meaningful limiter: the window is narrow and success is probabilistic, typically requiring multi-threaded, repeated attempts. No user interaction is required (UI:N) and no special non-default Windows configuration is needed since afd.sys is present and reachable on default installations, but the practical bar is the timing reliability plus needing an existing local account/process on the machine.

The signals are consistent and point to a real-but-not-urgent local EoP. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires local access and already-held low privileges, and importantly rates attack complexity High - reflecting the inherent unreliability of winning a TOCTOU race - while granting full C/I/A impact (SYSTEM) on success. EPSS is 0.03% (6th percentile) and there is no KEV listing and no identified public POC, so this is not a mass-exploitation candidate. There is no material conflict in the data: a low EPSS and High-complexity local race align, and the Microsoft-assigned CVSS matches the description. One minor inconsistency to note: the input Tags include 'Information Disclosure', but the description and CWE-367 describe privilege elevation - treat the primary impact as local EoP and verify the disclosure angle against the MSRC advisory. Prioritize as a routine but important Patch-Tuesday kernel EoP: high value to an attacker for post-compromise escalation, low likelihood of opportunistic mass use.

An attacker who already has a foothold as a standard user - for example via phishing, a compromised service account, or a low-privileged web/app process - runs a purpose-built program that repeatedly issues WinSock/afd.sys operations while a second thread flips the underlying resource state to win the check-to-use race. On a successful race, the kernel acts on attacker-controlled data and the attacker gains SYSTEM, enabling credential theft, tampering, and persistence. No public exploit code has been identified, and the High attack complexity means many attempts may be needed to hit the timing window.