Microsoft EUVD-2026-22469

The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides low-level network socket services and handles Winsock operations at the kernel level. This CWE-416 use-after-free vulnerability occurs when the driver incorrectly manages memory object lifecycles, allowing a pointer to reference freed memory. When triggered through specific socket API calls or I/O control codes (IOCTLs), the driver may reuse freed memory for a new allocation, enabling an attacker to control data at that memory location. Successful exploitation allows overwriting kernel memory structures to redirect code execution flow, typical of kernel-mode UAF primitives. The affected CPE strings span the entire modern Windows ecosystem: Windows 10 versions 1607 through 22H2 (builds 10.0.14393.x through 10.0.19045.x), all Windows 11 versions from 22H3 through 26H1 (builds 10.0.22631.x through 10.0.28000.x), and Windows Server editions from 2012 (6.2.9200.x) through Server 2025 (10.0.26100.x), including Server Core installations. The kernel-mode nature and breadth of affected versions underscore the fundamental role AFD.sys plays across the Windows networking stack.