EUVD-2026-35565
GHSA-v9vm-9353-cg37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privileged user shell
-
DeliveryOpen handle to \Device\Afd
-
ExploitRace concurrent Winsock IOCTLs
-
InstallTrigger use-after-free in afd.sys
-
C2Reclaim freed object with controlled data
-
ExecuteOverwrite token or kernel pointer
-
ImpactExecute payload as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local code execution on the target Windows host as an authenticated user (PR:L), with the ability to open handles to the AFD device (\Device\Afd) - the default-accessible Winsock kernel interface available to any interactive user. High attack complexity (AC:H) reflects the need to repeatedly trigger a narrow timing window in concurrent AFD IOCTL paths and successfully reclaim the freed kernel object, which is sensitive to CPU count, scheduling, and pool state. No user interaction is required (UI:N), and the attack works against default Windows configurations because AFD is enabled out-of-the-box on every Windows installation; remote exploitation is not possible (AV:L). |
| Impact | The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local, authenticated attacker who must overcome high attack complexity (winning a race window), with full CIA impact at kernel scope - consistent with a kernel LPE. No EPSS, KEV, or SSVC data was supplied; combined with the absence of any public PoC in the references, real-world urgency is moderate rather than emergency, but afd.sys bugs have a strong historical pattern of being weaponized post-patch (e.g., prior afd.sys LPEs added to KEV). The 'Denial Of Service' tag conflicts somewhat with the CVSS I:H/C:H rating that implies code execution, not just DoS - defenders should treat the higher-impact interpretation as authoritative until Microsoft's advisory clarifies. Only one reference (MSRC advisory placeholder) is provided, so detailed patch metadata, fixed build numbers, and exploitation telemetry are not independently verifiable from the supplied data. |
| Exploit ScenarioDerived | An attacker who has already obtained a low-privileged foothold - for example, via phishing-delivered malware running as a standard user - executes a small native binary that opens an AFD handle and repeatedly issues conflicting Winsock IOCTLs from multiple threads to win the race and trigger the use-after-free in kernel memory. By grooming the kernel pool and reclaiming the freed object, the attacker corrupts a process token or hijacks a kernel pointer to gain SYSTEM, enabling installation of persistent malware, credential theft (LSASS), or lateral movement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged user to elevate to SYSTEM by winning a race condition that triggers a use-after-free. The flaw is reported by Microsoft (MSRC) and carries CVSS 7.0 with high attack complexity, but no public exploit is identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45603 as soon as it is published for your Windows edition (patch available per vendor advisory; specific fixed build numbers must be taken from MSRC). Because exploitation requires local authenticated code execution, compensating controls until patching include restricting interactive and remote-desktop logon rights to trusted users, enforcing application allowlisting (WDAC/AppLocker) to prevent unsigned tooling from running, and enabling EDR detections for known afd.sys exploitation patterns (suspicious IOCTL sequences to \Device\Afd, token theft from System process); these controls reduce attacker dwell but do not block a determined insider and may break legitimate admin tooling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 33 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ancillary Function Driver for WinSock (afd.sys) is a kernel-mode driver that provides the user-mode Winsock API (ws2_32.dll) with access to kernel networking primitives, making it a long-standing surface for local kernel exploitation. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e., a race condition) that produces a use-after-free: two concurrent code paths operate on the same kernel object without adequate locking, allowing one thread to free the object while another still references it. Tags 'Race Condition' and 'Denial Of Service' corroborate the concurrency root cause, and successful UAF in afd.sys historically yields arbitrary kernel read/write and SYSTEM token replacement.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Windows Ancillary Function Driver (afd.sys) contains a local privilege escalation vulnerability allowing any authenticated user account to gain SYSTEM-level control, exposing all Windows systems to insider threats and lateral movement following account compromise. With no vendor patch available, this vulnerability creates an indefinite window of exposure for organizations with weak local access controls. The risk is magnified in environments with shared workstations, vendor remote access, or former-employee accounts not yet deprovisioned.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce least-privilege via Group Policy-remove standard users from local administrators group and apply 'Deny log on locally' to high-risk systems. (2) Enable Windows Defender Credential Guard on compatible systems to prevent credential theft from escalated processes. (3) Deploy behavior-based detection to alert on unexpected privilege escalation (Event ID 4688 with medium→system integrity transitions) and unsigned driver loading. (4) Restrict access to local system via remote desktop and physical console; disable unnecessary services that increase attack surface. (5) Implement code integrity policies (Device Guard/HVCI) to block kernel-mode exploitation where supported.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Windows AFD WinSock Use-After-Free Privilege Escalation
View all 5More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB