Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
This vulnerability is classified as a Use-After-Free (CWE-416) within the Windows Ancillary Function Driver (afd.sys), which serves as the entry point for the Windows Sockets (Winsock) interface. The flaw is triggered when the driver incorrectly manages memory objects during socket operations, allowing an attacker to reuse a memory pointer after it has been freed. To exploit this, an attacker must have local access to the system and be able to execute a specially crafted application. Successful exploitation enables the attacker to execute code with SYSTEM privileges, though the attack complexity is rated as high, likely due to race conditions or specific memory layout requirements. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory