Executive brief
A security vulnerability has been identified in a core Windows networking component that handles socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A null pointer dereference vulnerability (CWE-476) exists in the Windows Ancillary Function Driver (afd.sys), which is the kernel-entry point for the Windows Sockets (WinSock) API. The flaw is triggered when the driver fails to properly validate a pointer before dereferencing it during certain socket operations. An attacker with low-privileged local access can exploit this by running a specially crafted application to trigger the dereference, leading to local privilege escalation (LPE) to SYSTEM. Microsoft has released security updates to address this issue across affected versions of Windows 10, 11, and Server 2022.
Affected products
- Microsoft Windows 10 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2, 26H1
- Microsoft Windows Server 2022 Standard, 23H2 Edition
Timeline
- 2026-03-10: disclosed
- 2026-03-10: advisory