Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a system could exploit this flaw to gain full administrative control. This could allow them to bypass security restrictions, access sensitive data, or install malicious software across the affected machine.
Technical details
This vulnerability is a use-after-free (UAF) condition within the Windows Ancillary Function Driver (afd.sys), which serves as the entry point for the Windows Sockets (WinSock) API. The flaw is reportedly linked to a race condition (CWE-362) during concurrent execution using shared resources with improper synchronization. An attacker with low-privileged local access can exploit this by carefully timing operations to trigger the use of a memory object after it has been freed. Successful exploitation allows the attacker to execute code in kernel mode, leading to a full local privilege escalation (LPE) to SYSTEM. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: Microsoft published the security update guide.