CVE-2026-45598: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability exists in the Windows Ancillary Function Driver for WinSock (afd.sys), a kernel-mode driver that handles socket operations on Windows. The flaw is exploitable locally by any attacker who already holds a low-privilege account on the affected system, with no network access or victim interaction required, though exploitation requires overcoming high-complexity conditions such as precise memory layout or timing constraints. Successful exploitation grants the attacker full control over the host, elevating from a standard user to kernel-level privileges with complete read, write, and availability impact. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials to attempt exploitation.

• Victim interactionNot required

  No action by another user or administrator is needed; the attacker can trigger the vulnerability entirely through their own process.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must satisfy specific memory layout or timing conditions that are not reliably reproducible without additional preparation.

Blast Radius

• A successful attacker gains kernel-level code execution, reading any memory on the host including secrets, credentials, and session tokens held by other processes.
• The attacker can write to arbitrary kernel memory, modifying security policy, access tokens, or persisted data belonging to any process or user on the system.
• The attacker can crash or destabilize the kernel, causing a system halt or blue-screen that takes the entire host offline.
• Because privilege is elevated to the kernel, any container or process isolation on the affected host is subject to escape or bypass.