Windows Server 2012 CVE-2026-33100

Requires local authenticated user account (PR:L) on Windows system with Ancillary Function Driver for WinSock enabled. Attacker must exploit precise timing race condition (AC:H) in AFD.sys memory management to trigger use-after-free condition.

Real-world risk is moderate despite the 7.0 CVSS score. The CVSS vector reveals significant exploitation barriers: local access required (AV:L), high attack complexity (AC:H), and low privileges needed (PR:L) but no user interaction (UI:N). SSVC framework assessment confirms exploitation status as 'none' (no public exploit identified at time of analysis), not automatable, but with total technical impact if successfully exploited. The high attack complexity suggests exploitation requires precise timing or race condition manipulation, typical of kernel use-after-free bugs. While the vulnerability grants complete system compromise (C:H/I:H/A:H), the combination of local-only access, high complexity, and absence of public exploits reduces immediate mass-exploitation risk. This is a priority for organizations with untrusted local users or multi-tenant Windows environments, but lower urgency than remotely exploitable or actively exploited vulnerabilities. Patch deployment should follow normal security update cycles rather than emergency response, though privilege escalation vulnerabilities in kernel drivers remain attractive targets for advanced adversaries seeking post-compromise escalation paths.

An attacker with low-privileged local access to a vulnerable Windows system (domain user account, standard user, or compromised service account) executes a specially