What is the CVSS score of EUVD-2026-22499?

EUVD-2026-22499 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by EUVD-2026-22499?

CVE-2026-32073 is a local privilege escalation in Windows AFD.sys affecting all supported Windows versions and Server editions that allows low-privileged authenticated users to gain SYSTEM access…. A patch is available.

How to fix or mitigate EUVD-2026-22499?

Within 24 hours: Identify all Windows 10, Windows 11, and Windows Server 2012-2025 systems in your environment and verify current patch levels. Within 7 days: Apply vendor-released patches to all affected systems prioritizing servers and high-value workstations; test patches in non-production environments first due to kernel-level changes. Within 30 days: Complete patch deployment across entire Windows infrastructure and verify via vulnerability scanning or Windows Update reports.

Microsoft EUVD-2026-22499

| CVE-2026-32073 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

Denial Of Service Use After Free Memory Corruption Microsoft

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:17 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22499

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation via use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys) affects all supported Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012-2025. Authenticated local attackers with low privileges can exploit memory corruption to gain SYSTEM-level access, though high attack complexity suggests reliable exploitation requires sophisticated techniques. Vendor-released patches are available across all affected versions. No publi

Technical ContextAI

The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides support for network socket operations including asynchronous I/O and event notification. This use-after-free vulnerability (CWE-416) occurs when the driver incorrectly manages object lifetimes, allowing a freed memory region to be referenced after deallocation. In kernel-mode drivers, use-after-free conditions are particularly dangerous because successful exploitation can corrupt kernel memory structures, bypass security boundaries, and execute arbitrary code with SYSTEM privileges. The vulnerability affects the core networking stack present in all modern Windows versions from legacy Server 2012 through current Windows 11 26H1 releases, indicating a longstanding code path issue in AFD.sys. The CVSS vector indicates local access (AV:L) with high attack complexity (AC:H), suggesting exploitation requires precise timing or race condition wins, typical of kernel UAF exploits.

RemediationAI

Apply the vendor-released security updates immediately through Windows Update or WSUS infrastructure. Fixed versions include Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2012 build 6.2.9200.26026 or later, Windows Server 2016 build 10.0.14393.9060 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32073 for detailed update guidance and deployment considerations. No effective workarounds exist for kernel-mode driver vulnerabilities; patching is the only complete remediation. Prioritize patching for systems with multiple local users or where local access by untrusted users is possible.