Windows AFD Driver EUVD-2026-99879

Exploitation requires the attacker to already possess local, authenticated code-execution ability on the target (PR:L, AV:L) - there is no remote or network-facing vector and no path from an unauthenticated position. The attacker must exercise the Ancillary Function Driver for WinSock (afd.sys) socket code paths to trigger the use-after-free. The principal limiting factor is high attack complexity (AC:H): the UAF is a timing/race-dependent condition the attacker must reliably win, which resists automation (SSVC Automatable: no). No user interaction is required (UI:N), and default configurations are affected since AFD is loaded on all Windows installs, but the mandatory pre-existing local foothold meaningfully narrows realistic exploitation to shared, multi-user, or already-compromised hosts.

Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local-only use-after-free requiring the attacker to already have low-privilege authenticated code execution on the host and to win a high-complexity condition (typical of UAF race windows), yielding total confidentiality/integrity/availability impact (C:H/I:H/A:H) - hence the 7.0 base score. CISA's SSVC framework corroborates this restraint: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably scripted at scale, matching AC:H), and Technical Impact=total (matching full kernel compromise on success). There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS probability was supplied. Net: this is a genuine privilege-escalation primitive in a kernel driver - valuable as a second-stage chain link for an attacker who already has a foothold - but it is not a wormable, remote, or low-effort issue. Prioritize via normal Patch Tuesday cadence, with elevated attention on multi-user and shared/terminal-server hosts where untrusted users hold local accounts. No conflicting signals were found in the provided data; the main missing input is an EPSS score.

An attacker who has already obtained low-privileged authenticated access to a Windows host (e.g., via phishing, a compromised service account, or a standard user login on a shared machine) runs a local program that rapidly opens, uses, and frees WinSock/AFD objects to trigger the use-after-free race in afd.sys. On winning the race, they reclaim the freed kernel allocation with controlled data and corrupt kernel memory to execute code at SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means success depends on reliably winning a timing-sensitive race.