Windows afd.sys EUVD-2026-100102

Requires the attacker to already have valid local, low-privileged access to the target Windows host (PR:L) and the ability to execute code that invokes the Ancillary Function Driver for WinSock (afd.sys) - the standard kernel socket interface reachable by any local user process. Exploitation is further LIMITED by high attack complexity (AC:H): the CWE-415 double free hinges on winning a kernel memory-management race, which is non-deterministic and may require multiple attempts. No network vector and no victim user interaction are involved (UI:N). The host must be running an unpatched build below the fixed versions listed in the EUVD data (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650).

This is a legitimate but moderate-priority elevation-of-privilege flaw rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a consistent story: exploitation requires local access and existing low-level privileges (PR:L), and the high attack complexity (AC:H) reflects the race-condition nature typical of a CWE-415 double free in a kernel driver. The full C:H/I:H/A:H impact is expected because a successful AFD kernel exploit yields SYSTEM. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The CVE is NOT listed in CISA KEV and no public exploit code was referenced, so this is 'no public exploit identified at time of analysis' - note, however, that the Windows AFD driver (afd.sys) has a strong historical track record of weaponized LPE exploits (e.g., prior AFD CVEs reaching KEV), so the real-world exploit-development likelihood is higher than the absence of a POC here suggests. The AC:H requirement and need for pre-existing local authentication meaningfully reduce mass-exploitation risk; this is a second-stage/post-compromise privilege-escalation primitive, not an initial-access vector. CONFLICT TO NOTE: the input Tags label this 'Information Disclosure,' but the description and the full-integrity/availability impact describe privilege elevation - treat the tag as erroneous, not the description.

An attacker who already has a foothold as a standard (non-admin) user on a Windows host - via phishing, a low-privilege service account, or a prior exploit - runs a crafted program that issues malicious WinSock/AFD operations to trigger the double free in afd.sys. By winning the associated kernel race condition (reflecting AC:H), they corrupt kernel memory and escalate to SYSTEM. No public exploit was identified at time of analysis, so this currently requires attacker-developed tooling.