EUVD-2026-99192
GHSA-x4rf-7fc2-mm7x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local foothold
-
DeliveryInvoke crafted AFD WinSock IOCTL
-
ExploitTrigger type confusion in kernel driver
-
ExecutionCorrupt kernel memory objects
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated access to the Windows host as at least a low-privileged user (CVSS PR:L); it is not remotely reachable (AV:L) and needs no user interaction (UI:N). The target is the Ancillary Function Driver for WinSock (AFD.sys), which is present and loaded by default in all supported Windows versions, so no special configuration or non-default feature is needed - the limiting factor is purely the prerequisite low-privilege local foothold. There is no network vector, no victim-interaction requirement, and no documented dependency on optional roles or settings; the practical constraint is obtaining initial local code execution first. |
| Impact | This is a genuine patch-priority issue for Windows environments, though not an emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-complexity privilege-escalation flaw requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with kernel-level code execution via a type-confusion bug (CWE-843) in the AFD.sys WinSock driver. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code at time of analysis; the realistic risk is therefore a post-compromise escalation primitive rather than an initial-access or wormable threat. Weigh this against the product footprint: a kernel EoP affecting essentially the entire supported Windows ecosystem is a reliable component of attacker toolchains once a POC emerges, and AFD.sys is a historically favored EoP target, so it should be prioritized in routine patch cycles ahead of lower-impact local bugs. Missing signals (no EPSS, no KEV, no confirmed POC) mean the current probability of in-the-wild use is unverified and should not be presented as either confirmed-exploited or confirmed-safe. |
| Exploit ScenarioDerived | An attacker who already has a foothold as a standard (low-privileged) user - via phishing, a compromised service account, or a prior application exploit - runs a crafted program that triggers the type-confusion condition in the AFD WinSock driver. Mishandling of the incompatible object type corrupts kernel memory, letting the attacker execute code in the kernel context and elevate to SYSTEM. No public exploit code is identified in the provided data, and exploitation is entirely local with no user interaction required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
RemediationAI
Vendor-released patch: Microsoft has published fixes for this CVE, and the EUVD version data identifies the minimum patched build for each branch - update Windows 11 23H2 to 10.0.22631.7652 or later, Windows 11 24H2 to 10.0.26100.9711 or later, Windows 11 25H2 to 10.0.26200.9711 or later, Windows 11 26H1 to 10.0.28000.3231 or later, Windows 11 26H2 to 10.0.26300.9711 or later, Windows 10 21H2/22H2 to 10.0.19044.7807 or later, Windows 10 1607 and Windows Server 2016 to 10.0.14393.9612 or later, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9376 or later, Windows Server 2012 to 6.2.9200.26434 or later, Windows Server 2012 R2 to 6.3.9600.23470 or later, Windows Server 2022 to 10.0.20348.5761 or later, and Windows Server 2025 to 10.0.26100.33650 or later. Apply the corresponding cumulative update from the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70245 as soon as your patch cycle allows, prioritizing multi-user systems, RDP/VDI hosts, jump boxes, and any host where low-privileged local code execution is plausible, since the exploit prerequisite is only PR:L. No vendor workaround disables AFD.sys - it is a core, always-loaded Winsock component, so removing or renaming it is not a viable mitigation and will break networking. Compensating controls therefore have to reduce the chance of the prerequisite local foothold rather than the flaw itself: restrict interactive logon and RDP access to trusted administrators, enforce least privilege and remove unnecessary local accounts and unpatched third-party software that could give an attacker a low-privileged execution primitive, and use application control or WDAC/AppLocker to block untrusted binaries. These measures do not fix the type confusion, carry the operational cost of tighter access controls, and can disrupt legitimate workflows, so they are only a stopgap until the cumulative update is deployed. Monitor for kernel memory corruption or unexpected SYSTEM-level process creation from low-privileged parents as a detection backstop, and note that no public exploit code or confirmed active exploitation was identified at time of analysis, so prioritization should follow standard risk-based patch management rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AFD.sys is the kernel-mode Ancillary Function Driver that implements the kernel side of the Winsock (Windows Sockets) subsystem, exposing a device object that user-mode processes - including Winsock API calls made through ws2_32.dll - reach via IOCTLs and other I/O requests. The vulnerability is classified as CWE-843, Access of Resource Using Incompatible Type ('type confusion'): the driver processes a request and then interprets the underlying object or buffer according to a different type than the one it was created or validated as, which in a kernel driver typically produces out-of-bounds access or corrupted kernel memory structures. Because the affected code runs at kernel privilege and the attacker supplies the malformed input from user mode, the weakness class is commonly chained into reliable local privilege escalation through memory corruption in the kernel address space. The supplied tags (Information Disclosure, Memory Corruption, Microsoft) are consistent with this: a type confusion in AFD.sys can leak kernel memory and corrupt kernel data as a step toward elevating a low-privileged process. The CVSS vector confirms the impact is scoped to the local system (S:U) with high confidentiality, integrity, and availability impact, and the prerequisite is authentication as a low-privileged user (PR:L) - no network vector and no user interaction.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel EoP needing an existing low-privileged account (AV:L, PR:L), no user interaction, reliably triggerable (AC:L), yielding SYSTEM-level C/I/A impact within the same scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity flaw in AFD.sys, a networking driver present by default on every supported version of Windows 10, Windows 11, and Windows Server 2012 through 2025, allows anyone who already has a foothold on a machine to escalate from a standard user account to full SYSTEM control. Because the vulnerable component ships with the operating system, the exposure footprint is essentially the entire Windows estate rather than a niche application, and SYSTEM-level compromise on a workstation or server typically enables credential theft, lateral movement, and disabling of endpoint defenses. Leadership should treat this as a fleet-wide patch-priority item: there is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) activity, so urgency is driven by breadth of exposure rather than an active campaign.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB