Executive brief
A security vulnerability exists in a core Windows networking component that handles socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to install programs, view or delete sensitive data, or create new accounts with full user rights.
Technical details
This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) located within the Windows Ancillary Function Driver (afd.sys), which serves as the entry point for the Windows Sockets (WinSock) API. An attacker with low-privileged local access can exploit this race condition by timing a change to a shared resource between the moment the driver validates a condition and the moment it uses the resource. Successful exploitation allows the attacker to execute code with SYSTEM privileges. The vulnerability affects a wide range of Windows client and server versions, and Microsoft has released security updates to address the issue.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2008 R2 Service Pack 1 All versions
Timeline
- 2026-01-13: disclosed
- 2026-01-13: advisory