Windows Server 2012 CVE-2026-26177

Local user account required. Windows Ancillary Function Driver (AFD.sys) must be loaded. High complexity requires specific timing and heap manipulation during WinSock driver operation.

This vulnerability presents moderate real-world risk despite its 7.0 CVSS score. The attack requires local access with low-level user privileges (PR:L) and high complexity (AC:H), significantly constraining the attack surface compared to remotely exploitable flaws. No CISA KEV listing exists, indicating no confirmed active exploitation in real-world environments. No public exploit identified at time of analysis, which combined with the AC:H rating suggests weaponization requires substantial reverse engineering effort and expertise in Windows kernel exploitation. However, the technical impact is severe: successful exploitation grants full SYSTEM privileges with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). From an SSVC perspective, while exploitation status is 'none' and automatable status is 'no' (due to AC:H), the technical impact is 'total' given full privilege escalation. This vulnerability is most concerning in multi-user or server environments where adversaries already have initial access foothold and seek privilege escalation for lateral movement or persistence. The wide platform coverage (Windows 10 1607 from 2016 through current Windows 11 26H1 and Server 2025) demonstrates extensive exposure surface. Prioritization should focus on high-value servers and workstations where adversaries might chain this with initial access exploits, rather than treating it as an immediate critical emergency given the absence of active exploitation and public exploit code.

An authenticated local user sends specially timed socket requests to AFD.sys, causing a use-after-free condition in kernel memory. This allows arbitrary code execution at SYSTEM privilege level, bypassing authorization controls.