Microsoft Windows CVE-2026-50312

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low privileges (CVSS PR:L) and the ability to execute code that makes WinSock/socket syscalls into afd.sys - i.e., this is a post-access privilege-escalation primitive, not remotely reachable. No user interaction is required (UI:N) and no special non-default configuration is needed, since afd.sys is present and active in all supported Windows installations by default. The principal limiting factors are the local attack vector (an attacker must first obtain a foothold on the machine) and the need for the low-privilege authenticated context; there is no network-facing exposure.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local access with low privileges but total impact on confidentiality, integrity, and availability - consistent with SSVC 'Technical Impact: total.' However, the real-world urgency signals are moderate rather than severe: SSVC rates Exploitation as 'none' and Automatable as 'no,' EPSS is low at 0.31% (23rd percentile), and there is no CISA KEV listing or public POC. This is a classic reliable-but-not-yet-exploited local EoP: it requires an attacker to already have code execution on the host, so it is a chaining/post-compromise primitive rather than an initial-access or wormable threat. It should be patched on the normal-to-priority cycle given afd.sys's history of being weaponized once details emerge, but it is not an emergency drop-everything issue today. No signal conflicts are present - the local vector aligns with the description's 'elevate privileges locally.'

An attacker who already has a low-privileged foothold on a Windows host - for example through a phished user account or a compromised service - runs a crafted program that issues a specific sequence of WinSock socket operations to trigger the use-after-free in afd.sys, reclaims the freed kernel object with attacker-controlled data, and elevates to SYSTEM. From there they disable defenses, harvest credentials, and move laterally. No public exploit code is identified at time of analysis, but afd.sys UAF bugs are historically turned into reliable exploits.