Windows AFD WinSock CVE-2026-70342

The vulnerable code path in afd.sys is reachable via network socket activity (AV:N), requiring no prior authentication (PR:N) and no victim user interaction (UI:N). The primary limiting factor is attack complexity (AC:H): reliable UAF exploitation demands precise kernel heap manipulation - typically a specific sequence of allocations and frees to position attacker-controlled data in the freed memory slot, or exploitation of a race condition window - making this non-trivial and non-automatable at scale. No special non-default configuration of WinSock or Windows networking is required; WinSock is enabled by default on all Windows systems. Exploitation is not limited to any specific port or protocol beyond generic TCP/IP socket usage.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a genuine high-severity flaw: network-reachable, no authentication, no user interaction needed, and full C/I/A impact if exploitation succeeds. The moderating factor is AC:H - kernel UAF exploitation requires reliable heap grooming or race-condition timing, making casual mass exploitation unlikely, consistent with SSVC Automatable: no. SSVC Exploitation: none and the absence of KEV or public POC confirm no widespread in-the-wild activity is known. Despite the AC:H cap, the breadth of affected versions - every major Windows release including end-of-extended-support Server 2012 - and SSVC Technical Impact: total mean that any organisation that has not applied the Patch Tuesday update should treat remediation as urgent; even a mid-sized municipal IT team managing a mixed-version estate should treat this as urgent given the SYSTEM-level prize a successful exploit delivers. The 'Denial Of Service' tag in the source metadata appears to reflect a potential secondary crash impact of the UAF (kernel panic/BSOD) rather than the primary described impact of privilege escalation; this does not alter the overall priority.

An attacker with network access to a target Windows host sends specially crafted WinSock socket requests designed to trigger a race condition or memory-layout sequence that causes afd.sys to dereference a freed kernel object. By controlling the heap memory that fills the freed slot, the attacker redirects kernel execution to shellcode or a ROP chain, achieving SYSTEM-level code execution and full control of the host. No public proof-of-concept code has been identified, and the AC:H rating reflects that this attack requires non-trivial kernel heap grooming to execute reliably.