Windows AFD.sys CVE-2026-70225

Exploitation requires the attacker to already possess authenticated low-privileged local access to the target host and the ability to execute code that interacts with the Ancillary Function Driver for WinSock (AFD.sys) - a driver present and loaded by default in all supported Windows editions, so no special feature or non-default configuration is needed to reach the vulnerable code. LIMITING FACTORS: the attack vector is local only (AV:L), so there is no remote/network path; it requires valid low-level credentials or prior code execution (PR:L); and it affects a defined list of Windows 10/11 and Windows Server 2012-2025 builds below the patched versions in EUVD-2026-99199, so fully patched systems are not exploitable. No user interaction is required (UI:N).

This is a genuine patch-priority item but not an emergency. The CVSS 7.8 (HIGH) vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local (AV:L), low-complexity (AC:L) privilege escalation requiring the attacker to already hold low-level authenticated access (PR:L) with no user interaction, yielding total confidentiality/integrity/availability impact on the same system (S:U). All exploitation signals point AWAY from mass urgency: it is NOT in CISA KEV, SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit was identified at time of analysis - so there is no public exploit identified at time of analysis. The one signal that elevates it is SSVC Technical Impact 'total', consistent with the C:H/I:H/A:H kernel-level outcome. These signals are internally consistent: low real-world exploitation probability combined with high technical impact - a classic local EoP that is valuable as a chaining/post-compromise step rather than an initial-access break-in. Note the tags 'Information Disclosure' and 'Memory Corruption' partially conflict with the CWE-843 type-confusion EoP framing; the description explicitly says 'elevate privileges locally,' so treat this as a privilege-escalation flaw, with info disclosure being at most a secondary effect of the memory-corruption primitive. Given the ubiquity of Windows, prioritize patching within the normal monthly cycle; accelerate on multi-user hosts, terminal servers, and systems where untrusted users can execute code.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or a standard user login) runs a crafted program that issues malformed WinSock/AFD.sys requests to trigger the type-confusion condition in the kernel driver. By manipulating the mismatched object type, the attacker corrupts kernel memory to execute code at SYSTEM, achieving full local privilege escalation. No public exploit was identified at time of analysis, and exploitation requires local access with no user interaction.