Windows AFD.sys CVE-2026-70168

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target Windows system (AV:L, PR:L, no user interaction) - there is no remote or network-triggerable path. The attacker must interact with the WinSock/Ancillary Function Driver (AFD.sys) socket subsystem, which is present and reachable by any standard user on all Windows versions, so no special feature toggle or non-default configuration is needed. The principal limiting factor is the AC:H rating: the use-after-free is a timing-dependent race condition that may require winning a narrow window and multiple attempts, making reliable exploitation non-trivial and not automatable (SSVC Automatable: no). Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025; systems patched to the fixed build numbers listed in EUVD-2026-99191 are not exploitable.

This is a genuine but moderate-priority local privilege escalation in the Windows Ancillary Function Driver (AFD.sys/afd.sys) for WinSock, scored CVSS 7.0 (High). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: AV:L confirms a local vector (no remote reach), PR:L confirms the attacker must already be an authenticated low-privileged user on the box, and AC:H reflects the race-condition timing typical of a use-after-free (CWE-416) that is not trivially reliable to win. The C:H/I:H/A:H triad plus SSVC Technical Impact 'total' indicate that successful exploitation yields full kernel/SYSTEM compromise. Countervailing signals keep this below top-tier urgency: SSVC Exploitation is 'none' and the CVE is NOT on CISA KEV, there is no public POC identified, and SSVC Automatable is 'no' (consistent with AC:H - not a point-and-click, wormable, or mass-automatable flaw). No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from the input. Net: a real, patch-worthy local EoP that is a reliable post-exploitation step for attackers who already have code execution, but not an urgent internet-facing emergency. The 'Denial Of Service' tag is plausible as a secondary outcome of a kernel UAF but the authoritative description and CVSS frame this primarily as privilege elevation.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a web shell, or a standard user account) runs a crafted local program that manipulates WinSock/AFD socket objects to trigger the use-after-free and win a timing race, corrupting kernel memory to overwrite a pointer or token and gain SYSTEM privileges. No public exploit code was identified at time of analysis, so weaponization would require independent development, and the AC:H rating implies the race may need multiple attempts to succeed. This is a classic second-stage local EoP used to escalate from initial access to full host control.