EUVD-2026-22426Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated low-privilege users to gain SYSTEM-level access through use-after-free memory corruption. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, including Server Core installations. Vendor-released patches available across all affected platforms. No public exploit identified at time of analysis, though high-complexity local exploitation (CVSS AC:H)
Technical ContextAI
The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides core socket functionality and I/O management for network operations in Windows. This CWE-416 use-after-free vulnerability occurs when the driver improperly manages memory object lifecycles, allowing a pointer to reference freed memory. When subsequently dereferenced, this condition enables memory corruption in kernel space. AFD.sys operates at ring 0 with SYSTEM privileges, making successful exploitation particularly impactful. The vulnerability spans Windows NT kernel versions 6.2 (Server 2012) through 10.0.28000 (Windows 11 26H1), indicating a long-standing architectural issue in the WinSock ancillary function implementation. Use-after-free conditions typically arise from race conditions, improper reference counting, or incorrect synchronization between socket closure and ongoing I/O operations.
RemediationAI
Apply Microsoft security updates immediately through Windows Update or WSUS to upgrade to patched builds: Windows 10 1607/Server 2016 to 10.0.14393.9060 or later, Windows 10 1809/Server 2019 to 10.0.17763.8644 or later, Windows 10 21H2 to 10.0.19044.7184 or later, Windows 10 22H2 to 10.0.19045.7184 or later, Windows 11 22H3/23H2 to 10.0.22631.6936 or later, Windows 11 24H2/Server 2025 to 10.0.26100.32690 or later, Windows 11 25H2 to 10.0.26200.8246 or later, Windows 11 26H1 to 10.0.28000.1836 or later, Server 2012 to 6.2.9200.26026 or later, Server 2012 R2 to 6.3.9600.23132 or later, Server 2022 to 10.0.20348.5020 or later, and Server 2022 23H2 to 10.0.25398.2274 or later. No workarounds identified; patching is the sole remediation path. Reference Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26182 for deployment guidance and known issues. Prioritize patching for multi-user systems and servers accessible to lower-privileged accounts.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today