Windows 11 26h1
CVE-2026-25178
HIGH
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Windows Ancillary Function Driver for WinSock (AFD) in Windows 11 versions 24h2 and 26h1 contains a use-after-free vulnerability (CWE-416) that allows authenticated local attackers to escalate privileges through memory corruption. An attacker with local access could exploit this flaw to gain elevated system permissions, though no official patch is currently available.
Technical ContextAI
Classified as CWE-416 (Use After Free). Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
RemediationAI
Monitor vendor advisories for a patch.
More in Windows 11 26h1
View allRemote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Remote denial-of-service in Microsoft's HTTP/2 implementation allows unauthenticated network attackers to exhaust server
Local privilege escalation in the Windows Bluetooth Port Driver allows an authorized low-privileged attacker to elevate
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-pr
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today