EUVD-2026-35658
GHSA-rw6m-h6rx-3c9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged code execution on host
-
DeliveryOpen Winsock socket handles via AFD
-
ExploitTrigger race between IOCTL and teardown
-
ExecutionReuse freed kernel object with controlled data
-
PersistCorrupt kernel structure to swap process token
-
ImpactExecute payload as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have authenticated code execution on the target Windows host as a standard user (PR:L) - this is a post-compromise / sandbox-escape primitive, not a remote entry point. No user interaction is required (UI:N), but the high attack complexity (AC:H) indicates the use-after-free is reached only by winning a race condition or precisely grooming the kernel pool, so exploitation is non-deterministic and may require multiple attempts. Exploitation is limited to the local machine (AV:L), so network-only attackers without a foothold cannot trigger this directly; environments that prevent untrusted users from running arbitrary code (kiosks with WDAC, single-purpose servers) face materially lower risk. |
| Impact | Signals point to a credible but not yet urgent kernel EoP. The CVSS vector (AV:L/AC:H/PR:L/UI:N/C:H/I:H/A:H) confirms local-only exploitation by an already-authenticated user, with high attack complexity that typically denotes a race condition or non-deterministic pool grooming requirement; this is consistent with the use-after-free classification. There is no CISA KEV listing, no EPSS score provided, and no public POC referenced, so exploitation status is currently 'no public exploit identified at time of analysis.' Historically, AFD.sys UAF and type-confusion bugs (e.g., CVE-2023-21768, CVE-2024-38193) have been weaponized and added to KEV within months of patch - meaning real-world risk is materially higher than the 7.0 score suggests for any environment where untrusted code can run (multi-user servers, RDP/VDI, browsers, sandbox escape chains). No conflicts in the available signals, but EPSS and any vendor exploitability index from Microsoft are missing from input and should be cross-checked in the MSRC advisory. |
| Exploit ScenarioDerived | A low-privileged user (or code running inside a browser/Office sandbox after an initial RCE) issues a carefully timed sequence of Winsock IOCTLs to AFD.sys, racing socket teardown against another operation so that a freed kernel object is reused with attacker-controlled contents. The attacker leverages the resulting kernel memory corruption to overwrite a process token or call gate and elevate to NT AUTHORITY\SYSTEM, completing a sandbox escape or local privilege escalation. No public exploit identified at time of analysis, but the high attack complexity is consistent with a race that experienced exploit developers can stabilize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free condition in the kernel-mode driver. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but AFD.sys has a long history of being targeted for kernel EoP, making this a likely candidate for future weaponization. CVSS 7.0 reflects the high attack complexity required to reliably win the underlying race or reuse condition.
RemediationAI
Apply the Microsoft monthly security update that addresses CVE-2026-34335 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34335; exact patched build numbers per Windows SKU should be taken directly from that advisory as none were included in the provided data. Where patching must be staged, reduce exposure by minimizing the set of users who can execute arbitrary code on the host - restrict interactive logon on servers, harden RDP/Citrix/VDI sessions with AppLocker or WDAC to block unsigned binaries, and enforce LSA protection and Credential Guard so a kernel EoP yields less post-exploitation value. Note that disabling AFD.sys is not a viable workaround because it would break Winsock and all networked applications, so compensating controls focus on preventing the attacker from running the trigger code rather than removing the vulnerable surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 33 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode component that backs the Windows Sockets (Winsock) user-mode API, brokering socket I/O between user processes and the TCP/IP stack. Because every process that opens a socket interacts with AFD via IOCTLs, the driver is reachable from any authenticated context including low-integrity sandboxes. CWE-416 (Use After Free) indicates that an object in kernel-pool memory is referenced after it has been freed - typically due to a race between concurrent IOCTL handlers or improper reference counting on socket-related kernel objects - allowing an attacker who can groom the pool to coerce the kernel into operating on attacker-controlled data and ultimately corrupt kernel memory.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege escalation vulnerability in the Windows Ancillary Function Driver (AFD.sys) allows authenticated local users to gain system-level access, affecting all Windows systems with standard user access. No public exploit has been identified at time of analysis; however, AFD.sys has a documented history of kernel exploitation, making this a probable exploitation target. With no vendor patch currently available, immediate compensating controls are required to limit operational risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement privileged access management to limit standard user privileges; (2) Restrict local interactive logon rights on critical systems to administrators only; (3) Deploy application whitelisting on high-value systems to prevent execution of unknown drivers; (4) Enable kernel-mode driver signature enforcement; (5) Implement enhanced monitoring and alerting for abnormal AFD.sys or kernel-mode activity; (6) Conduct vulnerability scanning to identify systems running older Windows versions where kernel hardening is weak.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Windows Ancillary Function Driver WinSock UAF EoP
View all 2More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB