EUVD-2026-22398Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated attackers with low privileges to gain SYSTEM-level access through a race condition vulnerability. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Vendor-released patches available across all affected product lines. Attack complexity rated high (AC:H) but enables full system compromise with changed scope (S:C), indicating container/hypervisor escape potential. No public exploit identified at time of analysis, though the race condition class (CWE-362) is well-understood by exploit developers.
Technical ContextAI
The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides core network socket functionality to Windows applications. This vulnerability stems from a race condition (CWE-362) where multiple threads can concurrently access shared resources without proper synchronization primitives. In kernel drivers, race conditions often occur during object creation, deletion, or state transitions where time-of-check-to-time-of-use (TOCTOU) windows exist. The changed scope indicator (S:C) in the CVSS vector suggests the vulnerability allows escaping security boundaries, potentially affecting virtualization or container isolation. AFD.sys operates at ring 0 with SYSTEM privileges, making race condition exploitation particularly dangerous as successful exploitation grants complete kernel-level control. The high attack complexity (AC:H) reflects the precision timing and threading manipulation required to reliably win the race condition.
RemediationAI
Apply the vendor-released security updates immediately through Windows Update or WSUS. Fixed versions include Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 23H2/22H3 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2012 build 6.2.9200.26026 or later, Windows Server 2012 R2 build 6.3.9600.23132 or later, Windows Server 2016 build 10.0.14393.9060 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Detailed update guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26168. No workarounds exist for this kernel-level race condition; patching is the only effective mitigation. Prioritize domain controllers, virtualization hosts, and internet-facing systems where local access vectors are more feasible.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today