Executive brief
The Windows Ancillary Function Driver for WinSock is a system component that handles low-level network operations in Windows. A race condition vulnerability in this driver allows an authenticated attacker with local access to escalate their privileges to a higher level of system access, potentially gaining administrative control over the affected computer.
Technical details
This vulnerability is a concurrent execution race condition (CWE-362) in the Windows Ancillary Function Driver for WinSock, resulting from improper synchronization when multiple processes access a shared resource simultaneously. An authorized local attacker can exploit this timing-dependent flaw to escalate privileges. The vulnerability requires local access and existing authentication on the system. Exploitation allows privilege escalation but is not known to have been exploited in the wild. Microsoft has issued security updates to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed