Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A type confusion vulnerability (CWE-843) exists in the Windows Ancillary Function Driver for WinSock (afd.sys). The vulnerability is also characterized as a Use-After-Free (CWE-416) in some Microsoft documentation. An attacker with low-privileged local access can exploit this by sending specially crafted requests to the driver, causing it to access a resource using an incompatible type. Successful exploitation allows the attacker to execute code in kernel mode, leading to a full local privilege escalation (LPE). The attack requires a local presence and has a high complexity (AC:H) according to the CVSS vector. Microsoft has released security updates to address this issue across multiple versions of Windows and Windows Server.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 23H2, 24H2, 26H1
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019
Timeline
- 2026-05-12: disclosed: Initial disclosure by Microsoft
- 2026-05-12: advisory: NVD entry published
- 2026-06-01: other: Description updated to specify type confusion over use-after-free