Windows AFD.sys EUVD-2026-35658

Attacker must already have authenticated code execution on the target Windows host as a standard user (PR:L) - this is a post-compromise / sandbox-escape primitive, not a remote entry point. No user interaction is required (UI:N), but the high attack complexity (AC:H) indicates the use-after-free is reached only by winning a race condition or precisely grooming the kernel pool, so exploitation is non-deterministic and may require multiple attempts. Exploitation is limited to the local machine (AV:L), so network-only attackers without a foothold cannot trigger this directly; environments that prevent untrusted users from running arbitrary code (kiosks with WDAC, single-purpose servers) face materially lower risk.

Signals point to a credible but not yet urgent kernel EoP. The CVSS vector (AV:L/AC:H/PR:L/UI:N/C:H/I:H/A:H) confirms local-only exploitation by an already-authenticated user, with high attack complexity that typically denotes a race condition or non-deterministic pool grooming requirement; this is consistent with the use-after-free classification. There is no CISA KEV listing, no EPSS score provided, and no public POC referenced, so exploitation status is currently 'no public exploit identified at time of analysis.' Historically, AFD.sys UAF and type-confusion bugs (e.g., CVE-2023-21768, CVE-2024-38193) have been weaponized and added to KEV within months of patch - meaning real-world risk is materially higher than the 7.0 score suggests for any environment where untrusted code can run (multi-user servers, RDP/VDI, browsers, sandbox escape chains). No conflicts in the available signals, but EPSS and any vendor exploitability index from Microsoft are missing from input and should be cross-checked in the MSRC advisory.

A low-privileged user (or code running inside a browser/Office sandbox after an initial RCE) issues a carefully timed sequence of Winsock IOCTLs to AFD.sys, racing socket teardown against another operation so that a freed kernel object is reused with attacker-controlled contents. The attacker leverages the resulting kernel memory corruption to overwrite a process token or call gate and elevate to NT AUTHORITY\SYSTEM, completing a sandbox escape or local privilege escalation. No public exploit identified at time of analysis, but the high attack complexity is consistent with a race that experienced exploit developers can stabilize.