EUVD-2026-35557
GHSA-2x49-v893-m98f
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated low-privileged attacker to win a race condition and gain SYSTEM-level execution. The flaw is a use-after-free triggered through concurrent WinSock operations, and at time of analysis no public exploit has been identified and the CVE is not on the CISA KEV list.
Technical ContextAI
AFD.sys is the kernel-mode driver that backs the Windows WinSock (Windows Sockets) API, brokering socket I/O between user-mode applications and the TCP/IP stack. The root cause is CWE-362 (concurrent execution using shared resource with improper synchronization, i.e. a race condition) that culminates in a use-after-free: one thread frees an object while another retains and dereferences a stale pointer, allowing an attacker to reclaim and shape that freed memory before reuse. Because AFD.sys executes in ring 0, successful corruption of kernel objects translates directly into kernel-level code execution or privilege token manipulation. AFD has a recurring history of similar bugs (including prior CISA KEV-listed entries), which makes it a well-understood target for exploit developers.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45601 for your specific Windows SKU and build; the input does not contain an exact KB or fix version, so consult that advisory for the precise patch identifier (patch available per vendor advisory). Until patches are deployed, reduce attacker reach to the local prerequisite by enforcing least privilege on interactive and service accounts, restricting code execution on endpoints via WDAC or AppLocker, and enabling kernel-mode exploit mitigations such as Hypervisor-Protected Code Integrity (HVCI) and Kernel Control Flow Guard - recognising that HVCI can break some legacy drivers and reduce performance on older hardware. Removing or disabling afd.sys is not a viable workaround because WinSock-dependent networking would break.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today