Description

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-11T17:18:09.260Z",
  "pubdate": "2026-08-11T17:18:09.260Z",
  "executiveSummary": "This vulnerability is classified as a Use After Free (UAF) memory corruption flaw residing within the Windows Ancillary Function Driver for WinSock (afd.sys).\nSuccessful exploitation of this security defect allows a locally authenticated attacker to execute arbitrary code within kernel space, leading directly to a local privilege escalation (LPE) condition.\nThe affected product is the Microsoft Windows operating system, specifically targeting the kernel-mode networking infrastructure provided by the Ancillary Function Driver.\nThe primary risk implication is a complete compromise of the underlying host operating system integrity, as kernel execution privileges permit bypassing standard user-mode security boundaries, disabling security software, and accessing sensitive system resources.\nAttacker capabilities require local access to the target system with the ability to execute code, alongside sufficient authorization to interact with the WinSock AFD device driver interface.\nSpecific exploitation requirements generally entail manipulating heap memory allocations and object lifecycles to trigger the dangling pointer dereference under race condition or specific IOCTL command sequences.",
  "technicalDetails": "The root cause of the vulnerability stems from improper memory management within the Windows Ancillary Function Driver for WinSock, specifically in the handling of kernel object lifecycles and reference counting inside afd.sys.\nA Use After Free condition occurs when a driver fails to nullify a pointer to a dynamically allocated kernel memory buffer after the underlying memory has been freed or deallocated.\nWhen subsequent execution paths attempt to access the resource via the dangling pointer, memory corruption ensues.\nThe vulnerable component is the kernel-mode driver file afd.sys, which processes Input/Output Control (IOCTL) requests related to Windows Sockets operations.\nAuthentication requirements dictate that the attacker must already possess valid credentials and code execution capabilities within the local environment to interact with the device driver handle '\\Device\\Afd'.\nPrivilege requirements are low in terms of initial execution context, as standard local users can typically open handles to the AFD driver and issue socket-related system calls.\nNetwork exposure is strictly local, meaning remote exploitation over network interfaces is not directly feasible unless chained with a remote code execution vector that achieves local execution first.\nThe attack flow begins with the attacker initializing specific socket configurations and issuing a sequence of crafted IOCTL requests to the Ancillary Function Driver.\nThrough precise timing or manipulation of I/O completion packets, the attacker forces the driver to release the memory associated with a specific internal driver object while maintaining a reference to it.\nThe attacker then re-allocates the freed heap chunk with controlled payload data using secondary heap spraying techniques, such as creating appropriately sized objects or utilizing other kernel pool allocation primitives.\nWhen the driver subsequently dereferences the dangling pointer to interact with the original object, it instead operates on the attacker-controlled memory contents.\nThis payload behavior permits the redirection of kernel execution flow, facilitating the overwriting of function pointers or token manipulation to elevate the attacker's process security context to SYSTEM privileges.\nPost-exploitation impact includes persistent kernel-level access, ability to tamper with kernel structures, evasion of detection mechanisms, and total administrative control over the targeted Windows operating system instance."
}