CVE-2026-33100

What it actually does

This is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (AFD), a kernel-mode driver used by Windows networking components. An authenticated local attacker can trigger a use-after-free condition in kernel memory and, with successful memory manipulation, execute code with elevated privileges, typically SYSTEM-level privileges. The CVSS vector indicates local access, low privileges required, no user interaction, high attack complexity, and full confidentiality, integrity, and availability impact after successful exploitation.

Why it matters to the business

If exploited, this flaw can allow an attacker who already has a foothold on a Windows workstation or server to take full control of that system, disable security tooling, access sensitive data, install persistence, or move laterally. Because affected products include many supported Windows client and server versions, the exposure may be broad in mixed Windows environments. Current public exploitation signals are low: it is not listed in CISA KEV, is not known to be used in ransomware, has very low and flat EPSS, and has no reported exploit maturity; however, local privilege escalation bugs are commonly chained after phishing, credential theft, or remote-code-execution compromises.

How an attack unfolds

An attacker first needs authenticated local code execution on an affected Windows system, such as through a compromised user account, malicious script, dropped executable, or another vulnerability. The attacker then interacts with Windows networking interfaces that reach the Ancillary Function Driver for WinSock and attempts to trigger a timing-sensitive use-after-free condition. If the attacker can reliably shape kernel memory after the freed object is reused, they may redirect execution or manipulate kernel structures to elevate from a low-privileged user context to SYSTEM. After privilege escalation, the attacker can dump credentials, tamper with endpoint defenses, create privileged accounts, install services or scheduled tasks, and use the host as a launch point for lateral movement. There are currently no named threat actors, public exploit maturity, or KEV evidence provided for this vulnerability, so exploitation should be treated as plausible but not confirmed at scale.

How to fix it

Apply the relevant Microsoft security update for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. No specific fixed build numbers were provided in the input, so use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to identify and deploy the cumulative update that remediates CVE-2026-33100 for each operating-system release. Prioritize internet-facing servers, remote-access infrastructure, shared administrative workstations, domain-joined servers, virtualization hosts, and systems used by privileged administrators. Where immediate patching is not possible, reduce exposure by enforcing least privilege, preventing untrusted local code execution, restricting interactive logon rights, applying application control, enabling tamper protection, and monitoring for suspicious privilege escalation behavior. There is no safe configuration-only mitigation that should be considered equivalent to installing the vendor update.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows asset has installed the applicable Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate through centralized patch-management reports, Windows Update history, installed hotfix inventory, and OS build/revision checks against Microsoft’s official fixed build guidance. On representative systems, confirm the updated version of the Windows Ancillary Function Driver for WinSock driver, typically afd.sys, matches the version delivered by the remediating update. Run authenticated vulnerability scans after patch deployment and ensure scanners no longer report this vulnerability for the applicable Windows products. For systems that cannot be patched, document compensating controls and confirm they are covered by enhanced endpoint logging and behavioral detections for local privilege escalation.

Typical attack path

1. Gain initial local access to an affected Windows client or server using valid credentials, malware execution, phishing, or another vulnerability.
2. Run code as a low-privileged authenticated user on the target system.
3. Invoke Windows networking functionality that interacts with the Ancillary Function Driver for WinSock.
4. Trigger the use-after-free condition under favorable timing and memory-layout conditions.
5. Manipulate kernel memory to elevate privileges to SYSTEM or another high-integrity security context.
6. Use elevated privileges to disable defenses, access protected data, dump credentials, establish persistence, or move laterally.

How to detect it

Because this is a local kernel privilege escalation and no public exploit indicators are provided, detection should focus on behavioral evidence rather than fixed signatures. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, service-control events, scheduled-task events, Windows Error Reporting, and crash telemetry from affected systems. Look for low-privileged processes that unexpectedly spawn SYSTEM-level child processes, create or modify services, install drivers, disable security tools, dump credentials, or access LSASS shortly after initial execution. Useful Windows events include process creation events, special-privilege assignment events, service installation events, scheduled task creation events, driver load events, and unexpected bugcheck or application crash events involving kernel activity. For Sysmon-enabled hosts, review Event ID 1 process creation, Event ID 6 driver loaded, Event ID 7 image loaded where applicable, Event ID 10 process access to LSASS or security tooling, Event ID 11 file creation in sensitive paths, Event ID 12/13/14 registry modifications for persistence, and Event ID 22 DNS queries associated with follow-on activity. For Windows Security logs, review Event ID 4688 process creation, 4672 special privileges assigned, 4697 service installed, 4698 scheduled task created, 7045 service installed from the System log, and authentication events showing suspicious lateral movement after privilege escalation. Also inspect EDR timelines for execution from user-writable directories followed by token changes, privilege jumps, credential access, security-control tampering, or new persistence. Since no named threat actors or ransomware campaigns are associated with this issue in the input, absence of known IOCs should not be treated as proof of non-exploitation.

What your security team should do

• Inventory all affected Windows client and server versions and map them to the applicable Microsoft cumulative update or superseding update.
• Prioritize patching on servers, privileged-access workstations, shared endpoints, remote-access systems, and hosts where compromise would enable broad lateral movement.
• Use centralized deployment tools such as Windows Update for Business, WSUS, Configuration Manager, Intune, or equivalent endpoint-management tooling to enforce update installation and reboot completion.
• After deployment, validate with authenticated vulnerability scanning and OS build/update compliance reporting rather than relying only on patch job success status.
• Hunt for signs of local privilege escalation on unpatched systems, especially unexpected SYSTEM-level processes spawned from user-writable paths or shortly after suspicious low-privilege process execution.
• Strengthen least-privilege controls, application control, endpoint protection, credential protection, and tamper protection to reduce the usefulness of local privilege escalation vulnerabilities.
• Monitor Microsoft, CISA KEV, and threat-intelligence sources for any change in exploit maturity, public proof-of-concept availability, ransomware use, or active exploitation.