Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a computer could exploit this to view sensitive information that should have been protected. This could lead to the exposure of confidential data handled by the operating system or other applications.
Technical details
The Windows Ancillary Function Driver (afd.sys) for WinSock contains a vulnerability classified as CWE-319 (Cleartext Transmission of Sensitive Information). The flaw allows a locally authenticated attacker with low privileges to intercept or disclose sensitive data transmitted through the driver. The attack vector is local, requiring the attacker to have existing access to the target system, but no user interaction is required. Microsoft has released security updates to address this issue across various versions of Windows 10 and Windows 11.
Affected products
- Microsoft Windows 10 Version 1607 < 10.0.14393.9339
- Microsoft Windows 10 Version 1809 < 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 < 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 < 10.0.19045.7548
- Microsoft Windows 11 Version 23H2 < 10.0.22631.7376
- Microsoft Windows 11 Version 24H2 < 10.0.26100.8875
Timeline
- 2026-07-14: disclosed: Initial publication of CVE-2026-34346 by Microsoft and NVD.
- 2026-07-14: patched: Microsoft released security updates for affected Windows versions.