Windows AFD Driver CVE-2026-61348

Exploitation requires possession of a valid low-privileged local user account on the target Windows system (CVSS PR:L) and the ability to execute code in that user context - there is no remote unauthenticated attack path (AV:L). The Windows Ancillary Function Driver for WinSock (afd.sys) is a standard kernel component loaded by default on all affected Windows versions, meaning no special feature enablement or non-default configuration is required to expose the vulnerable code path. The primary limiting factor beyond authentication is high attack complexity (AC:H): exploitation likely depends on a race condition or precise heap state, so naive attempts are more likely to crash the system (BSOD) than succeed, and reliable exploitation requires sophisticated memory manipulation techniques. Exploitation is also host-local and does not traverse the network boundary; a firewall or network segmentation control does not mitigate this vulnerability.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a serious but practically bounded threat: exploitation is constrained to the local attack surface and demands meaningful technical sophistication (AC:H), yet succeeds fully when achieved. The High attack complexity metric is the most important limiting signal - it implies that exploitation likely depends on race conditions or precise heap state, reducing the reliability of off-the-shelf tooling and raising the bar for commodity attackers. No EPSS probability was included in the provided intelligence data, which is an explicit gap in the risk picture; without it, comparison against peer-class Windows kernel UAFs is not possible from this dataset alone. The vulnerability is not listed in the CISA KEV catalog, meaning confirmed active exploitation has not been reported to authorities as of analysis time. The tags note 'Denial of Service' as a secondary outcome, suggesting unreliable exploitation attempts may manifest as system crashes first, providing a potential detection signal. Even a mid-sized municipal IT team in zabrze operating mixed Windows 10 and Server 2019 fleets should treat this as urgent patching work, particularly on systems where untrusted or semi-trusted users hold interactive local sessions - shared workstations, VDI environments, or multi-tenant terminal servers represent the highest realistic risk scenario. The S:U (Unchanged scope) metric confirms that successful exploitation is bounded to the compromised host and does not by itself pivot to adjacent systems.

An attacker who has obtained a low-privileged Windows user account - through phishing, credential theft, or an earlier exploitation step - executes a crafted application that makes malformed or timed WinSock API calls, triggering a race condition or specific memory deallocation sequence in afd.sys that frees a kernel object while a reference to it remains live. By racing to reclaim the freed memory region with attacker-controlled content before the dangling pointer is dereferenced, the attacker redirects kernel execution and achieves SYSTEM-level code execution, enabling full host takeover including credential dumping and lateral movement. No public proof-of-concept exploit has been identified at time of analysis; the AC:H rating indicates the technique requires precise timing or heap shaping and is unlikely to be reliable via simple automation.