What is the CVSS score of CVE-2026-41088?

CVE-2026-41088 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows AFD Driver are affected by CVE-2026-41088?

A local privilege escalation vulnerability in the Windows Ancillary Function Driver affects Windows 10, 11, and Server 2022/2025 systems across enterprise environments.. A patch is available.

How to fix or mitigate CVE-2026-41088?

Within 24 hours: identify and inventory all Windows 10, Windows 11 (versions 21H2-26H1), and Windows Server 2022/2025 systems; prioritize critical infrastructure and systems with sensitive data or elevated privileges. Within 7 days: obtain the applicable Windows security patch from Microsoft's Patch Tuesday release, test in a non-production environment, and validate application compatibility. Within 30 days: deploy patches to all affected production systems beginning with critical and externally-facing servers, and verify 100% compliance using patch management tools (WSUS, SCCM, or equivalent).

Windows AFD Driver CVE-2026-41088

EUVD-2026-29680 HIGH

External Control of File Name or Path (CWE-73)

2026-05-12 microsoft

GHSA-cx4r-3gvx-xq57

Information Disclosure Microsoft Windows Server 2022 Windows Server 2025 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 11 Version 22H3 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Requires an existing low-privileged local session (AV:L, PR:L) with no user interaction; successful kernel-level escalation to SYSTEM yields total C/I/A impact on the same host (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:57 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.

Technical ContextAI

The Ancillary Function Driver for WinSock, afd.sys, is a core kernel-mode component that mediates user-mode socket API calls (the Winsock library) down to the TCP/IP stack; it runs at SYSTEM privilege and is present on every modern Windows installation, which is why it is a recurring local-privilege-escalation target. The root cause is CWE-73 (External Control of File Name or Path): a value influenced by an unprivileged caller is used to construct or reference a path/handle the driver acts upon, letting the attacker steer the driver into operating on an unintended object with kernel authority. The affected CPEs cover Windows 10 21H2/22H2, Windows 11 22H3/23H2/24H2/25H2/26H1, and Windows Server 2022 (including 23H2 Server Core) and Server 2025, confirming this is an OS-level kernel driver flaw rather than an application bug. Note the vendor tag labels this 'Information Disclosure,' which conflicts with the CVSS scope (full C/I/A) and the CWE-73 privilege-elevation framing.

RemediationAI

Apply the Microsoft security update via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41088 (Patch available per vendor advisory); install the cumulative update that brings each build to at least the fixed version - for example Windows 11 24H2 to 10.0.26100.8457, Windows 11 25H2 to 10.0.26200.8457, Windows Server 2022 to 10.0.20348.5139, and Windows Server 2025 to 10.0.26100.32860 (cite the exact build for your edition from the EUVD/MSRC data rather than assuming). Because afd.sys is a core kernel driver that cannot be disabled without breaking all Winsock networking, there is no safe feature-level workaround; the practical compensating controls until patching are to restrict and monitor interactive/low-privileged local logon on affected hosts (this flaw requires an existing local foothold), tighten least-privilege so fewer accounts can run local code, and deploy EDR detections for anomalous afd.sys handle/kernel-object manipulation - each reduces but does not eliminate exposure, so patching remains the only complete fix.