Description

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-11T17:19:06.357Z",
  "pubdate": "2026-08-11T17:19:06.357Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Windows Ancillary Function Driver for WinSock, potentially allowing local attackers to elevate privileges.\nThe vulnerability resides within the Windows Ancillary Function Driver (AFD), a core kernel-mode driver responsible for supporting Windows Sockets (WinSock) applications.\nAn authorized local attacker can exploit this flaw to execute arbitrary code with elevated privileges in kernel space.\nSuccessful exploitation requires local access and the ability to execute code on the target system to interact with the vulnerable driver interface.\nThe risk implications include complete system compromise, bypassing security controls, and arbitrary code execution at the highest privilege level (NT AUTHORITY\\SYSTEM).\nMitigation typically involves applying official vendor patches provided by Microsoft through regular security update channels.",
  "technicalDetails": "The vulnerability is a use-after-free (UAF) condition within the Windows Ancillary Function Driver for WinSock (afd.sys).\nA use-after-free flaw occurs when memory is dynamically allocated, subsequently freed, but a pointer to that memory address is retained and dereferenced later during execution.\nIn the context of afd.sys, improper handling of internal object references, handles, or Input/Output Control (IOCTL) requests can lead to premature deallocation of kernel objects while concurrent threads or subsequent operations still reference the memory block.\nThe affected component is the kernel-mode driver responsible for managing network endpoint structures and socket state transitions.\nAn attacker with local access and authorization to execute code on the system can interact with the AFD driver by opening a handle to device objects such as \\Device\\Winsock0 or associated endpoints.\nBy manipulating I/O control codes (IOCTLs) and engineering precise race conditions or heap layouts, the attacker forces the kernel to free a specific object while retaining a dangling pointer.\nThe attacker then performs heap feng-shui to re-allocate the freed memory region with attacker-controlled data, such as crafted socket structures or shellcode stub surrogates.\nWhen the driver subsequently accesses the dangling pointer, it processes the attacker-controlled data as legitimate kernel structures, leading to control flow hijacking.\nPost-exploitation impact includes arbitrary kernel-mode code execution, disabling security monitoring mechanisms, and full privilege escalation to SYSTEM.\nAuthentication requirements are minimal in terms of domain privileges, but local interactive or programmatic execution capability is required to interact directly with the driver subsystem."
}