What is the CVSS score of CVE-2026-45601?

CVE-2026-45601 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows AFD.sys are affected by CVE-2026-45601?

Windows AFD.sys contains a local privilege escalation vulnerability (CVE-2026-45601) that allows authenticated low-privileged users to gain SYSTEM-level access.. A patch is available.

How to fix or mitigate CVE-2026-45601?

Within 24 hours: Audit Windows systems and enumerate all user accounts with local interactive logon privileges; document which systems are business-critical. Within 7 days: Restrict local interactive logon to necessary accounts only via Group Policy; enable User Account Control (UAC) with 'Always Notify' setting; deploy endpoint detection and response (EDR) with behavioral monitoring for WinSock API abuse patterns. Within 30 days: Establish registry and event log monitoring baselines for WinSock operations; subscribe to Microsoft security advisories; apply vendor patch immediately upon release and validate across all systems.

Windows AFD.sys CVE-2026-45601

EUVD-2026-35557 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-2x49-v893-m98f

Denial Of Service Race Condition Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:10 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-privileged attacker to win a race condition and gain SYSTEM-level execution. The flaw is a use-after-free triggered through concurrent WinSock operations, and at time of analysis no public exploit has been identified and the CVE is not on the CISA KEV list.

Technical ContextAI

AFD.sys is the kernel-mode driver that backs the Windows WinSock (Windows Sockets) API, brokering socket I/O between user-mode applications and the TCP/IP stack. The root cause is CWE-362 (concurrent execution using shared resource with improper synchronization, i.e. a race condition) that culminates in a use-after-free: one thread frees an object while another retains and dereferences a stale pointer, allowing an attacker to reclaim and shape that freed memory before reuse. Because AFD.sys executes in ring 0, successful corruption of kernel objects translates directly into kernel-level code execution or privilege token manipulation. AFD has a recurring history of similar bugs (including prior CISA KEV-listed entries), which makes it a well-understood target for exploit developers.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45601 for your specific Windows SKU and build; the input does not contain an exact KB or fix version, so consult that advisory for the precise patch identifier (patch available per vendor advisory). Until patches are deployed, reduce attacker reach to the local prerequisite by enforcing least privilege on interactive and service accounts, restricting code execution on endpoints via WDAC or AppLocker, and enabling kernel-mode exploit mitigations such as Hypervisor-Protected Code Integrity (HVCI) and Kernel Control Flow Guard - recognising that HVCI can break some legacy drivers and reduce performance on older hardware. Removing or disabling afd.sys is not a viable workaround because WinSock-dependent networking would break.