Windows AFD Driver CVE-2026-50349

The attacker must hold a low-privilege authenticated local user account on the targeted Windows system (CVSS PR:L). The race condition is in the kernel Winsock AFD driver, which is active by default on all Windows installations - no non-default configuration is required. However, AC:H reflects that the attacker must precisely time concurrent socket operations to win the race window, making exploitation non-trivial and likely unreliable without a tailored exploit. Exploitation is limited to local access (AV:L): remote-only attackers cannot trigger this without first gaining local code execution through a separate vulnerability. No specific Winsock feature or application-level configuration needs to be enabled beyond the operating system's default network stack.

The CVSS score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a meaningful but constrained local privilege escalation. AC:H captures the inherent timing difficulty of winning a kernel race condition, which reduces the likelihood of reliable, automated exploitation compared to simpler LPE classes. PR:L means an attacker must already hold an authenticated local user account - this CVE is a post-exploitation stepping-stone, not an entry point. However, once the race is won, the full C:H/I:H/A:H impact means complete SYSTEM-level compromise. No EPSS data was supplied, no CISA KEV listing exists, and no POC has been identified. Despite the moderate-complexity rating, Windows kernel LPE bugs in afd.sys have historically attracted rapid weaponization by threat actors seeking privilege escalation after initial access. The broad version range (Server 2012 through Windows 11 26H1 and Server 2025) significantly expands the affected attack surface. Priority should be elevated for environments where endpoint privilege separation is a key control (e.g., shared VDI, multi-tenant servers, PaaS workloads).

An attacker who has obtained a low-privilege shell on a Windows system - for example via a phishing payload, a vulnerable web application running as a service account, or RDP brute force with a limited user account - launches concurrent WinSock socket operations designed to race the afd.sys synchronization window. By repeatedly triggering the vulnerable code path with crafted timing, the attacker wins the race condition, corrupts the shared kernel resource, and executes code in the kernel context, elevating to NT AUTHORITY\SYSTEM. No public POC has been identified, but this class of attack is well-understood and has been reliably implemented historically.