What is the CVSS score of EUVD-2026-22621?

EUVD-2026-22621 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by EUVD-2026-22621?

CVE-2026-33099 is a local privilege escalation vulnerability in Windows AFD.sys that allows low-privileged users with system access to gain SYSTEM-level control, affecting all supported Windows 10,…. A patch is available.

How to fix or mitigate EUVD-2026-22621?

Within 24 hours: Inventory all Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-25H2), and Windows Server 2012-2022 23H2 systems in your environment. Within 7 days: Apply Microsoft-released patches to all identified systems; prioritize domain controllers, servers running critical services, and administrative workstations. Within 30 days: Verify 100% patch deployment through endpoint management tools and confirm no systems remain unpatched in audit scans.

Microsoft EUVD-2026-22621

| CVE-2026-33099 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

GHSA-mvpf-27qc-fjcx

Denial Of Service Use After Free Memory Corruption Microsoft

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:36 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22621

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation via use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges across all supported Windows versions. Microsoft has released patches for Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-25H2), and Windows Server (2012-2022 23H2). The vulnerability requires local access and low privileges (PR:L) with high attack complexity (AC:H), but no public exploit

Technical ContextAI

The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides support for Windows Sockets (Winsock) operations, handling socket creation, I/O operations, and network protocol interfacing at the kernel level. This vulnerability stems from a use-after-free condition (CWE-416), a memory corruption class where the driver references memory after it has been freed, creating a window where an attacker can manipulate the freed memory region. The affected CPE strings indicate broad exposure across the entire Windows ecosystem: Windows 10 builds from version 1607 (released 2016) through 22H2, all Windows 11 versions including the latest 25H2, and Windows Server editions from 2012 through 2022 23H2, encompassing both full GUI and Server Core installations. The kernel-mode nature of AFD.sys means successful exploitation grants complete control over the operating system with SYSTEM-level privileges, bypassing all user-mode security boundaries.

RemediationAI

Vendor-released patches are available through Microsoft's standard update channels and should be applied immediately. Organizations should deploy the following patched builds: Windows 10 Version 1607 and Server 2016 to build 10.0.14393.9060 or later, Windows 10 Version 1809 and Server 2019 to build 10.0.17763.8644 or later, Windows 10 Version 21H2 to build 10.0.19044.7184 or later, Windows 10 Version 22H2 to build 10.0.19045.7184 or later, Windows 11 Versions 22H3 and 23H2 to build 10.0.22631.6936 or later, Windows 11 Version 24H2 to build 10.0.26100.32690 or later, Windows 11 Version 25H2 to build 10.0.26200.8246 or later, Windows Server 2012 to build 6.2.9200.26026 or later, Windows Server 2012 R2 to build 6.3.9600.23132 or later, Windows Server 2022 to build 10.0.20348.5020 or later, and Windows Server 2022 23H2 Edition to build 10.0.25398.2274 or later. Patches can be obtained through Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or enterprise patch management solutions. Consult the official security