CVE-2026-45596: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

Use-after-free vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock allows a local attacker to elevate privileges on affected Windows systems. Exploitation requires a low-privilege account on the target host but no network access or user interaction; the attacker must win a race condition to trigger the memory corruption. Successful exploitation gives the attacker full control over the system, enabling arbitrary code execution at elevated (kernel-level) privileges. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or system-level credentials to attempt exploitation.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability entirely through their own process activity.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must successfully win a race condition or satisfy other timing-dependent environmental factors to corrupt memory and gain elevated privileges.

Blast Radius

• A successful attacker gains kernel-level code execution on the compromised host.
• The attacker can read any data on the system, including credentials, session tokens, and sensitive files belonging to other users or processes.
• The attacker can modify or delete any files, registry keys, or persisted data on the host.
• The attacker can crash or disable system services, causing a denial of service for all workloads running on the host.