EUVD-2026-99193
GHSA-84pc-r9xh-9hgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain authenticated local access
-
DeliveryInvoke crafted WinSock socket operations
-
ExploitWin use-after-free race in afd.sys
-
ExecutionRead freed kernel memory
-
ImpactDisclose sensitive kernel data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated local access to the host (CVSS AV:L, PR:L) and the ability to run code that drives WinSock/afd.sys socket operations - no remote network path and no user interaction (UI:N) are involved. The attacker must also win a kernel-level use-after-free race condition (CVSS AC:H, CWE-362), which is non-deterministic and typically demands repeated timing attempts, substantially limiting reliable exploitation. Impact is confined to information disclosure (C:H); there is no integrity or availability effect, and the scope is unchanged (S:U), so no cross-component impact. No special non-default feature or configuration is named in the description - afd.sys is present by default on all supported Windows editions listed in EUVD. |
| Impact | This is a low-to-moderate real-world priority despite the HIGH confidentiality label. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7, Medium) tells a consistent story of a constrained local flaw: the attacker must already have local access and valid (low) privileges on the host, and must win a race condition (AC:H) to leak memory. The CWE-362 (race condition) classification and the 'Use after free' description align with AC:H. CISA's SSVC decision framework reinforces low urgency - Exploitation: none, Automatable: no, Technical Impact: partial - meaning no observed exploitation and no reliable, scalable weaponization. There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided in the input, so exploitation-probability cannot be quantified here. One data conflict should be noted: the input Tags include 'Denial Of Service,' but the description states only information disclosure and the CVSS vector sets A:N (no availability impact) and I:N - so the DoS tag appears mislabeled and should not drive prioritization. Net: a genuine local info-disclosure UAF worth patching in the normal Windows cycle, but not an emergency given the local vector, required privileges, race-condition complexity, and absence of exploitation evidence. |
| Exploit ScenarioDerived | An authenticated local user (for example, a standard user on a shared workstation or a low-privileged process in a sandbox) runs code that rapidly manipulates WinSock socket operations to trigger the use-after-free race in the Ancillary Function Driver (afd.sys). By winning the timing window, the attacker reads freed kernel memory and discloses sensitive contents such as kernel pointers or secrets, which could aid a subsequent privilege-escalation chain. No public exploit code was identified at the time of analysis, and the high attack complexity (race condition) means exploitation is non-deterministic and may require many attempts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.
RemediationAI
Microsoft has released fixes for this CVE (patch status: available from vendor, reported by secure@microsoft.com), so the primary action is to apply the current Windows cumulative security update for each affected branch through Windows Update, WSUS, Microsoft Update Catalog or your patch orchestration tool, and to verify the installed build meets or exceeds the thresholds in the affected-version ranges - such as 10.0.22631.7652 for Windows 11 23H2, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26100.33650 for Windows Server 2025, 10.0.17763.9376 for Windows Server 2019/Windows 10 1809 and 10.0.14393.9612 for Windows Server 2016/Windows 10 1607 - with the authoritative per-branch guidance in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70195. There is no meaningful feature-level workaround: afd.sys is a core kernel driver that cannot be disabled or unloaded without breaking Windows Sockets networking, and because the vector is AV:L/PR:L the exposure is limited to hosts where an attacker already has authenticated interactive access. Compensating controls therefore focus on reducing that prerequisite and on detection rather than prevention - restrict interactive logon and RDP access to trusted administrators, remove or disable unnecessary local accounts and shared-credential access, enforce least privilege so that low-privileged users cannot run arbitrary code on sensitive servers, and use kernel-level EDR/telemetry to flag anomalous local processes performing repeated socket allocation and teardown (a signature of attempts to win the AC:H race). The trade-offs are that tightening interactive logon or RDP access can disrupt legitimate administrative workflows and help-desk operations, and that race-based detection is noisy and prone to false positives because the exploitation attempts are, by design, repeated and low-probability; neither control removes the underlying flaw, so patching remains mandatory. Because the score is AV:L/AC:H and CISA SSVC records Exploitation: none and Automatable: no, emergency out-of-band deployment is not required, but the update should be folded into the next routine patch cycle with priority given to multi-user systems such as Remote Desktop Services hosts and servers where untrusted users can execute code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode driver that backs Windows Sockets, sitting between user-mode winsock calls and the TCP/IP stack; it is present by default on every supported Windows edition listed by EUVD. The vulnerability is described as a use-after-free, in which socket-related kernel memory is released while another thread or path still holds a reference to it, and it is tracked under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / race condition), the root-cause class that explains the high attack complexity in the CVSS vector (AC:H) and the non-deterministic nature of the bug. The mismatch between the CWE (race condition) and the textual description (use-after-free) is typical of a race-triggered UAF in afd.sys, where a win is needed in a narrow window between teardown and reuse; winning that window yields disclosure of kernel memory contents, consistent with C:H, I:N, A:N and S:U. Note that the supplied tags include 'Denial Of Service', which is not reflected in the assessed availability impact (A:N) and is best treated as a keyword artefact rather than a confirmed DoS capability. The MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70195) is the authoritative Microsoft source and maps the fixes to the cumulative build numbers listed in the EUVD affected-version ranges (EUVD-2026-99193).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and low privileges required for code execution on the host (AV:L/PR:L); race-condition timing gives AC:H; info-disclosure only yields C:H, I:N, A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB