CVE-2026-42911: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability exists in the Windows Ancillary Function Driver for WinSock (afd.sys), a kernel-mode driver that handles WinSock networking operations on Windows. Exploitation requires local access and a low-privilege account, and succeeds only when specific timing or memory-layout conditions are met, reflecting the High attack complexity rating. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the affected host, effectively achieving kernel-level privilege escalation. Patched-image rebuilds at the relevant fix versions are available on HarborGuard for environments running an affected Windows version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the vulnerability does not require administrative or elevated credentials before exploitation.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability entirely through their own process without involving another user.

• Attack complexityDetail

  Attack complexity is High, meaning the exploit depends on specific memory-layout or timing conditions that the attacker cannot fully control and may need multiple attempts to satisfy.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, session tokens, and other sensitive data held in kernel address space.
• Writes to kernel memory, allowing the attacker to modify security tokens and grant themselves SYSTEM-level privileges.
• Can crash or destabilize the affected system by corrupting kernel data structures, causing a denial-of-service condition.
• With SYSTEM-level access, the attacker can disable security tooling, install persistent backdoors, or pivot to other resources accessible from the compromised host.