Microsoft EUVD-2026-22416

The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver responsible for managing Windows Sockets networking operations. This vulnerability stems from CWE-416 (Use After Free), a memory corruption class where the driver references memory after it has been freed, creating a window for exploitation. In kernel-mode drivers, use-after-free conditions are particularly critical because successful exploitation occurs at ring 0 (kernel privilege level), bypassing all user-mode security boundaries. The AFD driver's role in socket management means it handles network I/O requests from user-mode applications, making it a consistent attack surface accessible to any authenticated local user. The CVSS vector indicates local attack vector (AV:L) with high attack complexity (AC:H), suggesting the vulnerability requires precise timing or race condition manipulation to trigger the use-after-free state reliably. The affected CPE strings span Windows 10 versions 1607 through 22H2, all Windows 11 versions including the latest 26H1, and Windows Server editions from 2012 through 2025, indicating this is a long-standing architectural weakness in the WinSock subsystem.