CVE-2026-45638: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) affects multiple versions of Windows 10 and Windows 11. The flaw is reached locally and requires only a low-privilege account, with no network access or victim interaction needed. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the affected host, effectively achieving kernel-level privilege escalation. Patched-image rebuilds at the relevant fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials to trigger the vulnerability.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can execute the exploit entirely through their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads protected memory and sensitive data accessible to the kernel, including credentials and session state held in privileged processes.
• Writes to or corrupts kernel data structures, allowing persistent modification of security controls or system configuration.
• Crashes or destabilizes the operating system, causing an unplanned reboot or denial of service for all workloads on the host.
• Achieves kernel-level code execution, enabling installation of rootkits or bypass of container isolation boundaries.