Windows AF_UNIX Socket CVE-2026-70565

Exploitation requires a local authenticated session on the affected Windows host with at least a standard (low-privileged) user account - CVSS PR:L confirms this. The attacker must be able to create AF_UNIX sockets, which requires no special privilege beyond a normal user session on Windows. The high attack complexity (AC:H) indicates that reliable exploitation additionally depends on precise heap-state manipulation or timing, such as a race condition between socket closure and a concurrent I/O operation; this is not trivially reliable and requires attacker-controlled timing. Exploitation cannot be performed remotely without first obtaining local code execution. No special non-default configuration or specific Windows feature enablement beyond the AF_UNIX Socket Provider being present (which it is by default on modern Windows) is required.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterises this as a local privilege-escalation flaw requiring a low-privileged account and high attack complexity - the latter almost certainly reflecting a race-condition or heap-grooming requirement typical of UAF exploits. The EPSS signal and KEV status are both absent from the provided data, so real-world exploitation cannot be confirmed. The vendor-confirmed patch and Microsoft's direct report (secure@microsoft.com) establish the flaw as genuine. The high AC:H metric significantly dampens near-term mass exploitation risk: UAF exploits against kernel socket providers require reliable heap manipulation, which is tooling- and environment-dependent. However, the breadth of affected Windows versions (Server 2012 through Server 2025, Windows 10 21H2 through Windows 11 26H1) is exceptionally wide, and any local code execution path - including containerised workloads or shared RDP sessions - represents a viable staging point. The 'Denial Of Service' tag in the metadata is misleading; the described impact is privilege escalation, not denial of service (though UAF exploitation can produce system crashes as a side-effect, explaining A:H).

A low-privileged local user logs into a multi-user Windows Server (e.g., via RDP or an application-tier shell) and runs exploit code that opens AF_UNIX sockets and races socket teardown operations to trigger a use-after-free condition in kernel memory. By carefully controlling heap allocations - using techniques such as pool spraying - the attacker places crafted data in the freed kernel object's location, redirecting execution to attacker-controlled code running at kernel privilege. No public exploit code has been identified at time of analysis.