Windows Server 2012 CVE-2026-27922

Local user account required with ability to interact with Windows Ancillary Function Driver for WinSock (afd.sys). Exploitation requires specific timing and heap layout conditions. No network access involved.

Real-world risk is moderate despite the 7.0 CVSS score, constrained by multiple exploitation barriers. The CVSS vector (AV:L/AC:H/PR:L/UI:N) indicates attackers must already have local authenticated access with low privileges and overcome high attack complexity, likely requiring race condition exploitation or precise timing to win the use-after-free window. The AC:H designation suggests reliable exploitation demands specialized techniques beyond simple API calls. No public exploit identified at time of analysis and absence from CISA KEV indicates this is not yet weaponized in active campaigns. However, the broad affected product range (all supported Windows versions) and complete impact triad (C:H/I:H/A:H) mean successful exploitation yields full SYSTEM privileges, enabling total host compromise including credential theft, persistence installation, and lateral movement preparation. This represents a valuable post-exploitation primitive for sophisticated attackers who have achieved initial access through other vectors (phishing, application exploits). Patch availability from Microsoft substantially reduces risk for organizations with functional patch management, shifting this from critical urgency to standard monthly patching priority. Organizations should prioritize patching for high-value targets (domain controllers, sensitive data servers) while treating this as a defense-in-depth concern rather than an imminent breach vector for standard endpoints.

An authenticated local user exploits a use-after-free vulnerability in afd.sys through carefully timed API calls to corrupt kernel heap memory. By controlling freed memory reuse, the attacker achieves arbitrary code execution at SYSTEM level, escalating privileges from user account.