Windows AFD Driver CVE-2026-70205

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level privileges (PR:L) - this is a privilege-escalation flaw, not a remote entry point - and the ability to invoke AFD/WinSock socket operations, which are available to standard users by default. There is no special non-default configuration or feature toggle named in the description; the Ancillary Function Driver (afd.sys) is a built-in, always-present component of WinSock. The primary limiting factor is the high attack complexity (AC:H): reliably triggering the type confusion likely depends on winning a race or achieving a specific kernel object/memory state, reducing exploit reliability. No user interaction is required (UI:N). Hosts are vulnerable only below the fixed build numbers listed per edition (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.0 HIGH) describes an attacker who must already have a foothold: local access with low privileges and no user interaction, but high attack complexity. The high-impact triad (C:H/I:H/A:H) reflects kernel-mode compromise - type confusion (CWE-843) in a kernel driver typically yields SYSTEM. Mitigating the raw severity: AC:H signals the exploit is not trivially reliable (likely requiring a race or precise heap/object state grooming), and PR:L means it is a post-compromise escalation step, not an initial access vector. On the exploitation side there is no public exploit identified at time of analysis - no CISA KEV listing and no POC indicator in the provided data - and no EPSS score was supplied, so widespread or automated exploitation is not evidenced. AFD.sys is a recurring, well-studied LPE target in Windows, so weaponization over time is plausible, but nothing in this dataset indicates active or imminent exploitation. No SSVC decision data was provided. Net: patch on a normal-to-prompt cadence as part of the Windows monthly cycle; treat as an escalation primitive attackers would chain after initial access rather than a standalone emergency.

An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing, a web exploit, or stolen user credentials) invokes crafted WinSock/AFD operations that trigger the type confusion in afd.sys, corrupting kernel memory to overwrite a token or hijack kernel control flow. Winning the condition implied by AC:H may require multiple attempts or specific timing, after which the attacker runs code as SYSTEM. No public exploit is identified at time of analysis, so this would require original exploit development.