CVE-2026-45601: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

Use-after-free vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock allows a local attacker with a low-privilege account to escalate their privileges on the affected host. The exploit runs entirely on the local machine, requires no network access, and succeeds only when the attacker can win a timing race or satisfy specific memory-layout conditions. Successful exploitation gives the attacker full control over the affected system, covering confidentiality, integrity, and availability. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or system-level credentials to attempt exploitation.

• Victim interactionNot required

  No user interaction is needed; the attacker executes the exploit entirely through their own process without involving another user.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must satisfy specific timing or memory-layout conditions, such as winning a race to trigger the use-after-free window, before the privilege escalation succeeds.

Blast Radius

• A successful attacker reads arbitrary memory from the kernel, exposing credential material, session tokens, or other sensitive data held by higher-privilege processes.
• The attacker writes to protected kernel structures, allowing modification of security policies, audit settings, or persisted configuration data.
• The attacker gains SYSTEM-level code execution on the host, giving full control over all processes and resources running on that machine.
• Kernel-level tampering can crash the affected service or trigger a system-wide fault, causing a denial of service for all workloads on the host.