EUVD-2026-22499Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation via use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys) affects all supported Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012-2025. Authenticated local attackers with low privileges can exploit memory corruption to gain SYSTEM-level access, though high attack complexity suggests reliable exploitation requires sophisticated techniques. Vendor-released patches are available across all affected versions. No publi
Technical ContextAI
The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides support for network socket operations including asynchronous I/O and event notification. This use-after-free vulnerability (CWE-416) occurs when the driver incorrectly manages object lifetimes, allowing a freed memory region to be referenced after deallocation. In kernel-mode drivers, use-after-free conditions are particularly dangerous because successful exploitation can corrupt kernel memory structures, bypass security boundaries, and execute arbitrary code with SYSTEM privileges. The vulnerability affects the core networking stack present in all modern Windows versions from legacy Server 2012 through current Windows 11 26H1 releases, indicating a longstanding code path issue in AFD.sys. The CVSS vector indicates local access (AV:L) with high attack complexity (AC:H), suggesting exploitation requires precise timing or race condition wins, typical of kernel UAF exploits.
RemediationAI
Apply the vendor-released security updates immediately through Windows Update or WSUS infrastructure. Fixed versions include Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2012 build 6.2.9200.26026 or later, Windows Server 2016 build 10.0.14393.9060 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32073 for detailed update guidance and deployment considerations. No effective workarounds exist for kernel-mode driver vulnerabilities; patching is the only complete remediation. Prioritize patching for systems with multiple local users or where local access by untrusted users is possible.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today