CVE-2026-34335: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock allows a local attacker with a low-privilege account to elevate their privileges on the affected host. The flaw is reached locally and requires no network exposure, but the attacker must already hold a valid user account on the system. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the host. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected Windows version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable service is required.

• AuthenticationRequired

  Any low-privilege local user account is sufficient; no administrative credentials are needed to attempt exploitation.

• Victim interactionNot required

  The attacker does not need to trick or involve another user; the exploit executes without any user interaction.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker likely depends on specific race conditions, timing windows, or memory layout factors to trigger the use-after-free reliably.

Blast Radius

• A successful attacker reads protected files, credentials, and memory belonging to other processes on the host.
• The attacker writes or modifies system files, registry keys, and process memory, enabling persistent changes to the host.
• The attacker can crash or hang the affected Windows kernel driver, disrupting network socket operations for all processes on the host.
• Because all three impact dimensions (confidentiality, integrity, availability) are rated HIGH, a fully weaponized exploit effectively gives the attacker kernel-level control of the compromised host.