Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
NVD: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Hunt for local privilege escalation racing Winsock IOCTL handling in the Ancillary Function Driver to trigger a kernel use-after-free and elevate a low-privileged process to SYSTEM on Windows hosts
Research details
Componentafd.sys (Ancillary Function Driver for WinSock) kernel-mode driver
PreconditionsLocal shell or interactive access to a Windows host with a vulnerable afd.sys build (all supported Windows 10/11 and Server releases from the Aug 2026 Patch Tuesday wave); attacker races Winsock IOCTL handling to trigger the use-after-free; CVSS AV:L/AC:H, pre-existing code execution at low privilege required, no network access needed. agent
Exploit notesCVSS attack complexity: HIGH | HIGH severity (CVSS 7.0) | Use-after-free triggered via race condition; exploited in the wild (state-sponsored activity reported) and patched in Microsoft Aug 2026 Patch Tuesday
SummaryUse-after-free in afd.sys, the kernel-mode driver underpinning the Windows Sockets API, allows a locally authenticated attacker to elevate to SYSTEM via a race condition. Exploited in the wild (August 2026 Patch Tuesday zero-day) and patched by Microsoft; no public PoC identified in this cycle.
Tia coverage
First reported2026-08-11
First exploit report2026-08-11
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.