Executive brief
A security vulnerability exists in a core Windows networking component responsible for handling web and network connections. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to steal sensitive data, install persistent malware, or disrupt business operations.
Technical details
A use-after-free vulnerability exists in the Windows Ancillary Function Driver (afd.sys), which is the kernel-entry point for the Windows Sockets (WinSock) API. The flaw is triggered when the driver improperly manages memory objects during socket operations, leading to a use-after-free condition or a heap-based buffer overflow (CWE-122). An attacker with low-privileged local access can execute a specially crafted application to exploit this memory corruption. Successful exploitation allows the attacker to run arbitrary code with SYSTEM privileges, effectively gaining full control over the affected host. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-06-09: advisory: Initial advisory published by Microsoft and NVD.
- 2026-06-09: patched: Security updates made available via Microsoft Update Guide.