Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A use-after-free (UAF) vulnerability exists in the Windows Ancillary Function Driver (afd.sys), which serves as the entry point for the WinSock interface. The flaw is triggered when the driver improperly manages memory objects during socket operations, allowing an attacker to reuse a memory pointer after it has been freed. To exploit this, an attacker must have local access and the ability to execute code with low privileges. Successful exploitation allows the attacker to execute code in kernel mode, leading to a full local privilege escalation (LPE). Microsoft has released security updates to address this issue across multiple versions of Windows and Windows Server.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2012 R2 and Base
Timeline
- 2026-04-14: advisory: Initial disclosure by Microsoft and NVD