Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling socket connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A use-after-free vulnerability exists in the Windows Ancillary Function Driver (afd.sys), which serves as the entry point for the Windows Sockets (WinSock) interface. The flaw is rooted in a race condition (CWE-362) during concurrent execution using shared resources with improper synchronization. To exploit this, an attacker must first have local access to the system with low-level user privileges. Successful exploitation allows the attacker to execute code with elevated system privileges, potentially leading to a full compromise of the host. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: advisory: Initial disclosure by Microsoft and NVD.
- 2026-06-09: patched: Security updates made available by Microsoft.