EUVD-2026-44055
GHSA-rpr2-8rvv-249v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP needing only an unprivileged foothold gives AV:L/PR:L/AC:L/UI:N; kernel compromise yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an already-authenticated local attacker to gain elevated (SYSTEM-level) privileges across a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Reported internally by Microsoft with a patch available, the flaw carries CVSS 7.8 with full confidentiality, integrity, and availability impact but no confirmed active exploitation; no public exploit identified at time of analysis.
Technical ContextAI
AFD.sys is the kernel-mode Ancillary Function Driver that underpins the Windows Sockets (WinSock) API, providing the interface between user-mode socket calls and the underlying TCP/IP transport stack. Because it runs in kernel space and is reachable from every unprivileged process that opens a socket, it is a recurring privilege-escalation target. The root cause is classified as CWE-73 (External Control of File Name or Path), meaning attacker-influenced input is used to construct a file or object path/reference that the driver then acts on with kernel privilege, allowing the attacker to redirect the operation to a resource of their choosing. The affected CPE set spans a wide Microsoft footprint: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025 including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-50462 via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50462; a patch is available from the vendor, so patching to the corresponding cumulative update for your specific Windows build is the primary and only complete fix (exact KB/version is not enumerated in the input - retrieve it from the MSRC update guide for your OS build). Because AFD.sys is core to all socket operations it cannot be safely disabled as a workaround, so no reliable configuration-based mitigation exists; compensating controls are limited to reducing local attacker footholds - restrict interactive and low-privilege local logon rights, enforce least privilege and application allow-listing to prevent unauthorized code from running, and prioritize patching on multi-user and terminal/RDP servers where untrusted local principals are most likely present. These controls reduce opportunity but do not remove the vulnerability, so patching should not be deferred.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today