What is the CVSS score of CVE-2026-34344?

CVE-2026-34344 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Ancillary Function Driver are affected by CVE-2026-34344?

CVE-2026-34344 is a local privilege escalation vulnerability in Windows Ancillary Function Driver for WinSock affecting Windows 10, Windows 11, and Windows Server 2012 that allows authenticated users…. A patch is available.

How to fix or mitigate CVE-2026-34344?

Within 24 hours: Identify all Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012 systems in your environment. Within 7 days: Deploy the March 2026 Microsoft security update (KB number to be confirmed upon release) to all affected systems, prioritizing servers and workstations with elevated privileges or sensitive data access. Within 30 days: Verify patch deployment across 100% of inventory through endpoint management tools and validate successful installation via Windows Update reporting.

Windows Ancillary Function Driver CVE-2026-34344

EUVD-2026-29603 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-12 microsoft

GHSA-j4xq-256r-c68q

Microsoft Information Disclosure Memory Corruption

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 18:34 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Type confusion vulnerability in Windows Ancillary Function Driver for WinSock enables local authenticated users to escalate privileges to SYSTEM level on Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. Microsoft has released patches through their March 2026 security update cycle. The vulnerability requires low-privilege local access but no user interaction, making it a high-value target for post-compromise lateral movement and persistence. CVSS 7.8 reflects complete system compromise potential, though EPSS data and KEV status are not available for this future-dated CVE.

Technical ContextAI

The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides core networking socket functionality for Windows applications. This vulnerability manifests as CWE-843 (Access of Resource Using Incompatible Type), commonly known as type confusion, where the driver incorrectly interprets memory objects as different types during socket operations. Type confusion in kernel drivers typically occurs when IOCTL handlers, callback functions, or object validation routines fail to verify object types before casting pointers, allowing attackers to trigger operations on mismatched data structures. The affected CPE strings indicate broad impact across Windows 10 builds from Anniversary Update (1607) through current versions, all Windows 11 releases including the latest 26H1 preview, and legacy Windows Server 2012 systems, suggesting the vulnerable code exists in a longstanding core networking component shared across these platforms.

RemediationAI

Apply the March 2026 cumulative security updates released by Microsoft for the affected Windows versions through Windows Update, WSUS, or Microsoft Update Catalog. Organizations should prioritize patching systems where low-privilege users have local access, including multi-user workstations, terminal servers, and systems accessible via remote desktop. For Windows Server 2012 environments nearing end-of-extended-support, consider accelerating migration to supported Windows Server versions as part of remediation strategy. If immediate patching is not feasible, implement compensating controls including: restricting local logon rights to essential users only via Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Allow log on locally'), deploying application control policies (AppLocker/WDAC) to prevent execution of unauthorized binaries by low-privilege accounts, and enabling credential guard on Windows 10/11 Enterprise to protect against credential theft following privilege escalation. Monitor for unusual elevation of privileges using Windows Event IDs 4672 (special privileges assigned) and 4673 (privileged service called). Note that restricting local logon rights may impact legitimate user workflows and requires testing in non-production environments before deployment.