Windows Server 2012 CVE-2026-33099

Local user account required on Windows system with Ancillary Function Driver for WinSock enabled. Requires specific sequence of socket operations and timing to trigger memory corruption window.

Real-world risk assessment reveals moderate-to-high concern despite the 7.0 CVSS score. The CVSS vector indicates local attack vector (AV:L) requiring low privileges (PR:L) but high complexity (AC:H), meaning exploitation demands specific timing conditions or race condition wins typical of use-after-free bugs in kernel drivers. The complete impact triad (C:H/I:H/A:H) confirms full system compromise upon successful exploitation. Critical risk factors include the vulnerability's presence in a core kernel networking component affecting every supported Windows version and the low privilege requirement making it accessible to any authenticated user account. Mitigating factors include high attack complexity suggesting reliability challenges for weaponization, no public exploit code identified, and absence from CISA KEV indicating no confirmed active exploitation campaigns. The local-only attack vector limits initial access scenarios but makes this vulnerability highly valuable as a second-stage privilege escalation primitive in multi-step attack chains. Organizations should prioritize patching for systems where untrusted authenticated users have access, including terminal servers, shared workstations, and environments with potentially compromised low-privilege accounts.

An authenticated local user exploits a use-after-free vulnerability in the Windows AFD driver by crafting specific WinSock API calls. Successful exploitation corrupts kernel memory, allowing privilege escalation from user to SYSTEM level.