Windows AFD.sys CVE-2026-50462

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not a remote entry point, so it must be chained with a separate initial-access or RCE vulnerability to be useful. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once an unprivileged foothold exists, exploitation against a default-configured, unpatched AFD.sys is straightforward with no special feature toggle described. The principal limiting factor is the local-access precondition and the need for a valid (even unprivileged) account or process context on the machine.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) describes a low-complexity local attack requiring only low existing privileges and no user interaction, yielding full CIA impact - a classic and reliable EoP profile once an attacker already has a foothold. No EPSS score, KEV listing, or POC is provided, so there is no evidence of active or imminent exploitation; this is a proactive Patch-Tuesday-style fix (reported by Microsoft itself) rather than a confirmed in-the-wild threat. One conflict to flag: the Tags list 'Information Disclosure' while the Description and CVSS (I:H/A:H) clearly indicate privilege elevation with integrity and availability impact - the tag appears mislabeled or inherited, and the EoP framing should be treated as authoritative. Real-world priority is moderate-to-high for defenders because it is a chainable second-stage exploit (pair with any RCE/initial-access bug to reach SYSTEM), but it is not a remote or wormable issue.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via phishing, a compromised service account, or a chained remote exploit - invokes crafted socket/IOCTL operations against AFD.sys that abuse its externally-controllable path/reference handling to run code in kernel context and escalate to SYSTEM. The low attack complexity and lack of required user interaction make this a dependable second stage, though it requires pre-existing local access and no public exploit is currently identified.