AFD WinSock Driver CVE-2026-34346

Exploitation requires a locally authenticated session with at minimum a standard (low-privilege) user account on the affected Windows system - the CVSS vector PR:L confirms this. The attack is entirely local (AV:L); no network-based attack path exists. No user interaction by a third party is required once the attacker holds a local session. What limits exploitation: the attacker must first obtain local system access (physical, RDP, terminal services, etc.) through some means not covered by this CVE; remote unauthenticated exploitation is not possible. There is no indication from the description or SSVC data that any special non-default configuration is required - a standard Windows installation with the WinSock stack (present by default on all affected platforms) is sufficient. The limiting factor is purely the local access prerequisite, making this a post-compromise information disclosure risk rather than an initial-access vector.

The CVSS 3.1 score of 5.5 (Medium) accurately reflects a constrained local-only attack: AV:L eliminates remote exploitation, AC:L means no special circumstances are required once local access is obtained, and PR:L restricts exploitation to authenticated users - any domain or local account suffices. The C:H impact reflects that confidentiality exposure can be complete for the data in transit, but I:N and A:N mean no modification or disruption occurs. These CVSS signals align with SSVC findings: exploitation is classified as none, the attack is not automatable (no scripted remote path), and technical impact is partial. EPSS at 0.21% (11th percentile) further confirms that the security community has not observed or projected exploitation activity. The absence of KEV listing and no identified POC code reinforce low near-term risk. Real-world priority is accordingly low for network-perimeter defenses, but meaningful in environments where insider threats, shared workstations, multi-tenant VDI, or untrusted local users are threat model concerns. No conflicting signals between CVSS, EPSS, and SSVC were observed.

An attacker who has obtained a low-privilege local account on a vulnerable Windows system - for example, through credential phishing or exploitation of a separate initial-access vulnerability - invokes Winsock API calls or monitors driver-level data paths to intercept sensitive information transmitted in cleartext through afd.sys. No public exploit code has been identified at time of analysis, meaning this scenario currently requires manual, targeted effort by a skilled local attacker rather than commodity tooling.