What is the CVSS score of EUVD-2026-56564?

EUVD-2026-56564 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows AFD Driver are affected by EUVD-2026-56564?

A local privilege escalation in Windows Ancillary Function Driver (afd.sys) enables low-privileged users to achieve full system control through memory corruption, creating direct path to complete…. A patch is available.

How to fix or mitigate EUVD-2026-56564?

Within 24 hours, identify all Windows systems in your environment and catalog which users have local interactive logon access, particularly on remote-accessible systems or shared corporate machines. Within 7 days, deploy the following controls: restrict local logon privileges to essential administrative staff only using Group Policy (edit DefaultLogonType and RestrictAnonymous settings), enable AppLocker or Windows Defender Application Guard to block exploitation attempts, configure services to run under dedicated low-privilege service accounts rather than user accounts, and disable optional WinSock features via Group Policy if operationally acceptable. Within 30 days, establish monitoring rules to detect exploitation indicators (afd.sys crashes with memory corruption signatures, unexpected SYSTEM privilege escalation from user processes), confirm Windows Update enablement for rapid patch deployment when available, and create an emergency patching runbook for immediate deployment once Microsoft releases CVE-2026-70307 patch.

Windows AFD Driver EUVD-2026-56564

| CVE-2026-70307 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-55vx-6m9g-4qcv

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only attack requiring low privileges and a race condition (AC:H); full CIA reflects kernel-level control post-exploit; no scope change as impact stays within the compromised host.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:55 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.

Technical ContextAI

The Windows Ancillary Function Driver (afd.sys) is a core kernel-mode driver that implements the WinSock transport-layer interface, bridging user-space socket calls with underlying network protocol drivers in the Windows kernel. CWE-416 (Use After Free) describes a class of memory safety vulnerability where a memory object is freed but a dangling reference to it persists and is subsequently dereferenced - in a kernel driver context, this can corrupt kernel pool memory, allowing an attacker to redirect execution flow or overwrite sensitive kernel structures (e.g., process tokens) to gain elevated privileges. Because afd.sys operates in kernel space, a successful exploit yields SYSTEM-level code execution. The high complexity rating (AC:H) suggests exploitation depends on a race condition or specific memory-layout prerequisite such as heap grooming.

RemediationAI

Apply the Microsoft security update addressing CVE-2026-70307, available through Windows Update or the Microsoft Update Catalog as part of the relevant Patch Tuesday release. The exact patched build version is not confirmed from the available data - refer to the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70307 for the specific KB article and affected product list. As a compensating control where immediate patching is not feasible, restrict local interactive logon and remote desktop access to only trusted administrators, reducing the pool of accounts capable of triggering the vulnerability. Note that restricting network socket access via AppLocker or Windows Defender Application Control policies may partially reduce attack surface, but these controls have operational trade-offs and do not eliminate the underlying flaw.