Windows Server 2012 EUVD-2026-22398

Attacker must have low-privilege local user account access on Windows system running Ancillary Function Driver for WinSock. Requires specific timing conditions (race condition) to trigger the vulnerability. No user interaction needed. Affects Windows versions with this driver enabled (default on most Windows installations).

This vulnerability presents significant risk despite requiring local authenticated access. The CVSS base score of 7.8 reflects high impact across confidentiality, integrity, and availability with changed scope indicating security boundary violations. Attack complexity is high (AC:H), requiring precise timing to exploit the race condition, which historically reduces weaponization likelihood compared to simpler privilege escalation vectors. Requires low-privileged authentication (PR:L), limiting initial attack surface to scenarios where attackers already have user-level access through social engineering, supply chain compromise, or chained exploits. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not yet widely exploited in the wild. However, race conditions in Windows kernel drivers have proven exploitable historically (e.g., CVE-2021-1732), and the widespread deployment across all Windows versions from Server 2012 to Windows 11 26H1 creates extensive attack surface. SSVC framework suggests medium priority: exploitation not confirmed, moderate automatable potential given race timing requirements, but maximum technical impact due to kernel-level privilege escalation. Organizations should prioritize patching on high-value targets and multi-tenant environments where the changed scope impact is most severe.

An attacker with standard user credentials on a corporate workstation executes a malicious application that spawns multiple threads targeting AFD.sys socket operations. By carefully timing concurrent system calls to create a race condition during resource synchronization, the attacker manipulates kernel object states to execute arbitrary code with SYSTEM privileges. The attacker then disables security software, establishes persistence via kernel rootkit installation, and pivots to domain controller compromise using stolen credentials from memory.