CVE-2026-45603: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a local attacker with a low-privilege account to escalate their privileges on the affected host. The attack is local-only and requires the attacker to already hold an authenticated session on the machine; no network exposure is involved. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the system. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege authenticated account on the host is sufficient; no administrative rights are needed to begin the attack.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability entirely through their own actions.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must contend with race conditions or specific memory layout conditions that make reliable triggering non-trivial.

Blast Radius

• A successful attacker gains the ability to read privileged memory, including credentials, tokens, and kernel data structures accessible only to elevated processes.
• The attacker can write to protected kernel or user-space memory, allowing persistent modification of security controls, audit logs, or application data.
• The attacker can crash or hang the affected Windows host, causing a full denial of service for all processes and workloads running on it.
• Because the vulnerability resides in the kernel-level WinSock driver, privilege escalation from a low-privilege container or user context to SYSTEM-level control is achievable.