What is the CVSS score of CVE-2026-45596?

CVE-2026-45596 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows AFD.sys are affected by CVE-2026-45596?

A privilege escalation vulnerability in Windows' afd.sys driver (CVE-2026-45596) allows authenticated local users to gain SYSTEM-level control through a kernel race condition, affecting all Windows…. A patch is available.

How to fix or mitigate CVE-2026-45596?

Within 24 hours: Audit local logon permissions-identify all users and service accounts with RDP, console, or interactive logon rights. Within 7 days: Implement least-privilege controls-restrict local logon to named administrators only, disable interactive logon for service accounts, and enforce multifactor authentication on all privileged accounts. Monitor Windows security logs for unexpected privilege escalations. Within 30 days: Maintain vigilance for Microsoft security update-apply patch immediately upon release with priority equal to a critical vulnerability.

Windows AFD.sys CVE-2026-45596

EUVD-2026-35560 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-32m9-jm89-hm8p

Denial Of Service Race Condition Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:13 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local user to gain SYSTEM-level rights by winning a race condition that leads to a use-after-free in kernel memory. The flaw affects Windows installations where afd.sys is loaded (effectively all desktop and server SKUs) and was reported by Microsoft Security Response Center; no public exploit identified at time of analysis and the vulnerability is not listed on the CISA KEV catalog.

Technical ContextAI

The Ancillary Function Driver (afd.sys) is the kernel-mode driver that backs the Winsock user-mode API, handling socket I/O requests issued via DeviceIoControl. CWE-362 (race condition) combined with the description of a use-after-free indicates that two concurrent threads can manipulate a shared socket-related kernel object such that one path frees the object while another retains and dereferences a stale pointer, yielding a controllable write or call primitive in kernel context. AFD.sys has been a recurring LPE target on Windows (e.g., CVE-2023-21768, CVE-2024-38193), and exploitation typically pivots through I/O ring or pipe-attribute primitives to overwrite a process token and obtain SYSTEM. No CPE strings were provided in the input, so exact affected Windows build numbers must be confirmed from the Microsoft advisory.

RemediationAI

Apply the Microsoft monthly security update that addresses CVE-2026-45596 to all Windows endpoints and servers; the exact KB article and patched afd.sys file version should be retrieved from the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45596, as no specific fixed version was supplied in the input data. No vendor-released patched build was independently confirmed in the provided intelligence beyond the MSRC reference. Compensating controls until patching is complete: restrict local logon and interactive sessions to trusted users (this bug requires PR:L), constrain or block execution of unsigned binaries via WDAC/AppLocker to reduce the pool of attackers who can deliver a race-condition exploit, enable HVCI/VBS so that kernel exploitation primitives become harder to realize, and monitor EDR for anomalous afd.sys-related crashes or token-swap behavior - note that VBS/HVCI can introduce measurable performance overhead on older silicon, and AppLocker policies must be tested against business apps.