Microsoft CVE-2026-27917

The vulnerability resides in wfplwfs.sys, the Windows Filtering Platform (WFP) NDIS Lightweight Filter (LWF) driver, a kernel-mode component that provides packet filtering and network inspection capabilities within the Windows networking stack. The CWE-416 use-after-free condition occurs when the driver improperly manages memory object lifetimes, allowing continued access to freed memory regions. WFP operates at multiple network layers and integrates with NDIS (Network Driver Interface Specification) to intercept and process network traffic. A use-after-free in this privileged kernel component creates conditions where a local attacker with low privileges (PR:L) can manipulate freed memory allocations to redirect kernel execution flow. The affected wfplwfs.sys driver is present across all modern Windows client and server versions, from legacy Windows 10 1607 (build 14393) through current Windows 11 26H1 (build 28000) and Windows Server 2012 R2 through 2025, making this a widespread kernel vulnerability affecting the core networking subsystem.