Windows Server 2012 CVE-2026-26173

Local user account required on Windows system with Ancillary Function Driver for WinSock enabled. Attacker must execute code locally and successfully trigger timing-dependent race condition during WinSock operations. No network access possible.

This vulnerability presents moderate real-world risk despite the CVSS 7.0 HIGH rating. The CVSS vector reveals critical mitigating factors: Local attack vector (AV:L) limits exposure to attackers with existing system access, High attack complexity (AC:H) indicates race condition exploitation requires sophisticated timing and multiple attempts, and Low privileges required (PR:L) means attackers need authenticated user credentials. However, the complete CIA impact (C:H/I:H/A:H) and potential for privilege escalation to SYSTEM make this valuable in multi-stage attacks. The absence of public exploit code and no KEV listing suggests limited active exploitation, but race conditions in kernel drivers remain attractive for APT actors and red teams seeking post-compromise privilege escalation. Microsoft's simultaneous patching across 21 distinct Windows versions indicates vendor assessment of material risk. Organizations should prioritize patching on servers and endpoints where local access by potentially malicious users is plausible (terminal servers, multi-user systems, compromised workstations in lateral movement scenarios).

An attacker with low-privileged user credentials on a Windows system executes a specially crafted program that repeatedly triggers AFD.sys operations while