Windows Server 2012 CVE-2026-32073

Authenticated local user account required. Windows Ancillary Function Driver for WinSock must be accessible. Specific sequence of function calls to trigger use-after-free condition in driver memory handling.

This vulnerability presents a moderate-to-high risk profile requiring careful contextual assessment. The CVSS base score of 7.0 reflects high impact (complete confidentiality, integrity, and availability compromise) but is tempered by local attack vector and high complexity requirements. The AC:H rating indicates exploitation is not trivial and likely requires deep technical knowledge of Windows kernel internals, precise timing, or specific system states. PR:L (low privileges required) means any authenticated local user can attempt exploitation, which is concerning in shared environments or when combined with other access vectors. No public exploit identified at time of analysis, reducing immediate risk, though kernel-level use-after-free primitives are valuable to sophisticated threat actors and exploit developers. Patch availability from vendor across all affected versions significantly reduces risk for organizations with effective patch management. The broad version coverage (10+ years of Windows releases) suggests widespread exposure in enterprise environments still running legacy systems. SSVC assessment: exploitation status is POC/None, automatable is No (requires local access and complexity), technical impact is Total (kernel-level code execution). This vulnerability warrants priority patching for systems where local access by potentially malicious users is possible, particularly multi-user servers, terminal servers, and workstations in zero-trust environments.

An attacker with low-privileged local access to a Windows system (such as a standard domain user on a corporate workstation or a compromised service account on a server) executes a specially crafted program that triggers the use-after-free condition in AFD.sys through carefully sequenced WinSock API calls. By manipulating socket operations and timing, the attacker causes the kernel driver to reference freed memory, then reallocates that memory region with controlled data structures. Successful exploitation corrupts kernel memory to redirect execution flow, allowing the attacker to execute arbitrary code in kernel mode with SYSTEM privileges, achieving complete control over the compromised system. The high attack complexity suggests this requires sophisticated exploit engineering and may need multiple attempts or specific system conditions.