Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A type confusion vulnerability exists in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw stems from the driver accessing a resource using an incompatible type, which can be triggered through specific local IOCTL requests. While the advisory also mentions race conditions (CWE-362) and use-after-free (CWE-416) in its change history, the primary root cause is identified as type confusion. An attacker with low-privileged local access can exploit this to execute code in kernel mode, leading to a full local privilege escalation (LPE) to SYSTEM. Microsoft has released security updates to address this issue across supported versions of Windows and Windows Server.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 23H2, 24H2, 25H2, 26H1
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
Timeline
- 2026-05-12: disclosed: Initial disclosure by Microsoft
- 2026-05-12: advisory: MSRC advisory published
- 2026-06-01: other: Description updated from race condition to type confusion