# CVE-2026-70195: Windows Ancillary Function Driver for WinSock use after free

Source: https://junglewise.ai/threats/cve-2026-70195-use-after-free-in-windows-ancillary-function-driver-for-winsock  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-70195 · Severity: medium · CVSS 4.7 · Published 2026-10-13

Windows Ancillary Function Driver for WinSock is a low-level network component that handles specialized socket operations on Windows systems. A use-after-free vulnerability allows an authenticated attacker to read sensitive information from system memory, potentially exposing credentials or other confidential data.

Technologies: [Microsoft Windows Ancillary Function Driver for WinSock](https://junglewise.ai/threats/technologies/windows-ancillary-function-driver-for-winsock). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-70195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70195 being exploited in the wild.

**How severe is CVE-2026-70195?** Medium severity, with a CVSS score of 4.7, published 13 October 2026.

**Which products and versions are affected?** Microsoft Windows Ancillary Function Driver for WinSock.

**Is there a fix for CVE-2026-70195?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-70195 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-70195?** Check whether you run Microsoft Windows Ancillary Function Driver for WinSock. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability in the Ancillary Function Driver for WinSock allows an authorized local attacker to disclose information. The vulnerability requires local access and authenticated privileges; exploitation results in information disclosure from kernel memory.

## Affected products

- Microsoft Windows Ancillary Function Driver for WinSock

## Timeline

- 2026-10-13: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70195](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70195)

## Related threats

- [Windows Ancillary Function Driver for WinSock type confusion privilege escalation](https://junglewise.ai/threats/cve-2026-70245-access-of-resource-using-incompatible-type-type-confusion-in)
- [Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.](https://junglewise.ai/threats/cve-2026-68820-microsoft-windows-ancillary-function-driver-for-winsock-use-after)
- [Microsoft Windows WinSock Ancillary Function Driver type confusion](https://junglewise.ai/threats/cve-2026-41088-microsoft-windows-winsock-ancillary-function-driver-type)
- [Microsoft Windows Ancillary Function Driver type confusion privilege escalation](https://junglewise.ai/threats/cve-2026-34345-microsoft-windows-ancillary-function-driver-type-confusion)
- [Microsoft Windows type confusion in Ancillary Function Driver for WinSock](https://junglewise.ai/threats/cve-2026-34344-microsoft-windows-type-confusion-in-ancillary-function-driver-for)