Windows AFD.sys EUVD-2026-35558

Exploitation requires the attacker to already hold valid low-privileged credentials and the ability to execute code locally on the target Windows host (PR:L, AV:L) - pure remote network exploitation is not in scope. The CVSS AC:H signals a real limiting factor: the attacker must reliably win a race between concurrent Winsock IOCTL paths in afd.sys, which depends on CPU scheduling, core count, and pool state, so single-shot exploitation will sometimes fail and need to be retried. No user interaction is required (UI:N), and because afd.sys is loaded by default on every supported Windows SKU, there is no non-default feature flag or optional component that has to be enabled - any host where a low-privileged user can run code is in-scope.

The CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately conveys that this is a local, high-complexity, authenticated bug with full CIA impact on the host - high consequence but non-trivial to reach reliably because of the race window (AC:H). The vulnerability is not on the CISA KEV list and no public exploit has been identified at time of analysis, so it is not currently a drop-everything patch. However, AFD.sys race-condition UAFs (e.g. CVE-2023-21768, CVE-2024-38193) have repeatedly been weaponised by both commodity malware and APT groups as post-exploitation LPE primitives, so historical base rates argue for prompt patching on multi-user, terminal-server, and developer endpoints. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here; tagging as 'Denial Of Service' alongside RCE-class impact suggests the same race can also be triggered for crash-only outcomes against less-skilled attackers.

An attacker who already has low-privileged code execution on a Windows host - for example via a phished user account on a shared workstation, an RDP-accessible jumpbox, or a foothold from another bug - launches a process that opens multiple Winsock handles and races IOCTL calls against them to trigger the use-after-free in afd.sys. After grooming the kernel pool to reclaim the freed object with attacker-controlled data, the dangling dereference yields arbitrary kernel write, which is converted into SYSTEM by overwriting the process token. No public exploit is identified at time of analysis, but the AFD.sys attack surface has well-known offensive tooling that can be adapted.