What is the CVSS score of CVE-2026-34335?

CVE-2026-34335 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Windows AFD.sys are affected by CVE-2026-34335?

A privilege escalation vulnerability in the Windows Ancillary Function Driver (AFD.sys) allows authenticated local users to gain system-level access, affecting all Windows systems with standard user…. A patch is available.

How to fix or mitigate CVE-2026-34335?

24 hours: Inventory all Windows systems potentially affected; restrict low-privilege user local access through group policy where feasible; enable enhanced monitoring for AFD.sys-related activity. 7 days: Implement compensating controls (privileged access management, application whitelisting on critical systems); assess whether high-value systems can be air-gapped or restricted to administrators-only access. 30 days: Monitor vendor security advisories for patch availability; prepare deployment plan with tested rollout schedule; document any systems that cannot be patched and implement additional compensating controls.

Windows AFD.sys CVE-2026-34335

EUVD-2026-35658 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-rw6m-h6rx-3c9p

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.0 Vendor: microsoft

Temporal: 6.1

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.1 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:32 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free condition in the kernel-mode driver. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but AFD.sys has a long history of being targeted for kernel EoP, making this a likely candidate for future weaponization. CVSS 7.0 reflects the high attack complexity required to reliably win the underlying race or reuse condition.

Technical ContextAI

The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode component that backs the Windows Sockets (Winsock) user-mode API, brokering socket I/O between user processes and the TCP/IP stack. Because every process that opens a socket interacts with AFD via IOCTLs, the driver is reachable from any authenticated context including low-integrity sandboxes. CWE-416 (Use After Free) indicates that an object in kernel-pool memory is referenced after it has been freed - typically due to a race between concurrent IOCTL handlers or improper reference counting on socket-related kernel objects - allowing an attacker who can groom the pool to coerce the kernel into operating on attacker-controlled data and ultimately corrupt kernel memory.

RemediationAI

Apply the Microsoft monthly security update that addresses CVE-2026-34335 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34335; exact patched build numbers per Windows SKU should be taken directly from that advisory as none were included in the provided data. Where patching must be staged, reduce exposure by minimizing the set of users who can execute arbitrary code on the host - restrict interactive logon on servers, harden RDP/Citrix/VDI sessions with AppLocker or WDAC to block unsigned binaries, and enforce LSA protection and Credential Guard so a kernel EoP yields less post-exploitation value. Note that disabling AFD.sys is not a viable workaround because it would break Winsock and all networked applications, so compensating controls focus on preventing the attacker from running the trigger code rather than removing the vulnerable surface.