Windows AFD.sys CVE-2026-57093

Exploitation requires the attacker to already have local, authenticated access to the target (CVSS PR:L) and the ability to run their own code that makes Winsock/socket syscalls into afd.sys; it is a local elevation-of-privilege bug (AV:L), not remotely reachable over the network. No user interaction is needed (UI:N) and the attack complexity is low (AC:L), but the requirement for prior low-privilege code execution is the key limiting factor. The vulnerable afd.sys driver is present in default configurations of all listed Windows client and server versions, so no non-default feature or setting must be enabled - the constraint is foothold and reliable kernel-heap grooming, not special configuration.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) describes a low-complexity, low-privilege local escalation with no user interaction and total impact - a classic post-compromise SYSTEM escalation rather than an initial-access bug. All exploitation signals point to lower immediate urgency than the severity alone suggests: EPSS is only 0.25% (16th percentile), CISA SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified at time of analysis, so this is not currently a mass-exploited threat. However, AFD.sys use-after-free bugs are historically favored in exploit chains and by commodity malware for local escalation once a foothold exists, and SSVC rates the technical impact as total - so despite low EPSS this warrants prompt patching on multi-user, terminal-server, and endpoint systems where untrusted code may run. No signals are strongly conflicting; the local-only AV is consistent with the elevation-of-privilege description.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a compromised service account, or a standard user login on a shared/terminal server - runs a crafted program that issues malformed socket operations to afd.sys to trigger the use-after-free and reclaim the freed kernel object. By controlling the reallocated memory they corrupt kernel structures to execute code as SYSTEM, completing a local privilege escalation. No public exploit is identified at time of analysis, so this would require the attacker to develop or obtain a working exploit.