Executive brief
Windows includes a socket provider for AF_UNIX connections, a standard component used by some network applications. A use-after-free vulnerability in this provider allows an authenticated local user to escalate privileges from their current account level to a higher privilege level, potentially gaining administrative access.
Technical details
This is a use-after-free vulnerability in the Windows AF_UNIX Socket Provider, a kernel-mode or system-level component handling Unix domain socket operations. The vulnerability requires local access and authentication, meaning an attacker must already have a valid account or session on the target system. By exploiting the use-after-free condition through crafted AF_UNIX socket operations, an authenticated local attacker can execute arbitrary code with elevated privileges. Microsoft has released a security patch to address this issue.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed: CVE-2026-70565 published