Windows AFD Driver CVE-2026-70307

Exploitation requires a local, authenticated session on the target Windows system with at least low-privileged account access - consistent with PR:L in the CVSS vector. The description's use of 'authorized attacker' confirms this: unauthenticated remote exploitation is not possible. The high attack complexity (AC:H) indicates an additional prerequisite beyond basic access, most plausibly a race condition that must be won or a specific kernel heap state that must be engineered prior to the trigger. No specific non-default configuration, feature flag, or service enablement is described as required, as afd.sys is loaded by default on all Windows systems that support networking. Exploitation is limited by: requirement for a local foothold, the need to win a timing-dependent race, and the risk of a system crash (BSOD) on failed attempts.

The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a genuine but constrained risk. The local attack vector limits exposure to authenticated users already present on the target system, making remote exploitation impossible without a prior foothold. High attack complexity (AC:H) further reduces practical exploitability - exploitation is unlikely to be reliably automated without additional development effort. The 'authorized attacker' phrasing in the description confirms at minimum low-privileged account access is required. No EPSS data was provided, and the CVE is not listed in CISA KEV, suggesting no observed active exploitation. The tags listing 'Denial of Service' alongside privilege escalation suggests the use-after-free may cause a system crash (BSOD) in failed exploitation attempts, which could be a secondary risk in targeted environments. Real-world priority is moderate: this is a meaningful local privilege escalation in a ubiquitously deployed Windows component, but the AC:H constraint limits its utility except as a post-compromise escalation step.

An attacker who has obtained a low-privileged local account on a Windows system - via phishing, credential theft, or lateral movement - crafts a sequence of WinSock API calls designed to trigger a race condition in afd.sys that frees a kernel object while a concurrent reference to it remains live. By winning the race and placing controlled data in the freed memory region through kernel pool manipulation, the attacker corrupts a kernel structure (such as a process token) to elevate their process to SYSTEM privileges. No public proof-of-concept code has been identified, meaning reliable exploitation likely requires bespoke kernel exploit development.