EUVD-2026-35564
GHSA-cqjv-c8hw-93x7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Ancillary Function Driver (AFD.sys) for WinSock allows an authenticated low-privileged user to gain SYSTEM-level access through a use-after-free condition. The flaw was reported by Microsoft (MSRC) and carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the AFD.sys driver has a long history of similar bugs being weaponized post-disclosure.
Technical ContextAI
AFD.sys is the kernel-mode Ancillary Function Driver that backs the user-mode Winsock (ws2_32.dll) API on Windows, brokering socket operations between applications and the TCP/IP stack. The root cause is CWE-122 (heap-based buffer overflow), though the description specifies a use-after-free - indicating that AFD.sys frees a heap-allocated object but retains or reuses a stale pointer, allowing controlled memory corruption in the kernel pool. AFD.sys is reachable from any user-mode process via standard Winsock calls, making it a high-value attack surface that has been repeatedly targeted (e.g., CVE-2023-21768, CVE-2024-38193) for local privilege escalation.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45638 as soon as it is available for your Windows build; exact patch KB numbers should be retrieved from that advisory since they were not included in the provided data. As a compensating control until patching, restrict local interactive and remote-shell access to Windows hosts to trusted administrators only, since exploitation requires local code execution context - this is a meaningful mitigation on servers but largely impractical on user workstations. Application allowlisting (Windows Defender Application Control / AppLocker) can block unsigned exploit binaries from running, with the trade-off of operational overhead for software changes; AFD.sys itself cannot be safely disabled because Winsock depends on it.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today