CVE-2026-34335

What it actually does

CVE-2026-34335 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Ancillary Function Driver for WinSock, afd.sys. An authenticated attacker with low privileges can manipulate AFD/Winsock kernel interactions so that freed kernel memory is reused in an unsafe way, potentially allowing controlled kernel memory corruption. Successful exploitation can allow the attacker to execute code in kernel context or elevate privileges to NT AUTHORITY\SYSTEM, resulting in full confidentiality, integrity, and availability impact on the local host. The attack requires local access, prior authentication, and high exploitation complexity, which reduces opportunistic exploitation likelihood but does not materially reduce risk after an attacker has gained an initial foothold.

Why it matters to the business

This vulnerability can turn a limited compromise of a Windows workstation or server into full administrative control of that system. In practical terms, an attacker who has already obtained a low-privileged account or code execution path could disable security tools, dump credentials, install persistence, access sensitive data, or move laterally. The affected product set spans many supported Windows desktop and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so exposure may be broad in mixed enterprise environments. The current EPSS score is low and stable, the vulnerability is not listed in CISA KEV, and no exploit maturity is reported, so immediate mass exploitation is not indicated; however, local privilege escalation flaws are commonly chained with phishing, malware, remote access, and edge-device compromises.

How an attack unfolds

An attacker first needs authenticated local access to an affected Windows system, typically through malware execution, stolen user credentials, an interactive session, or another vulnerability that provides low-privileged code execution. The attacker then runs a purpose-built exploit that interacts with the Windows Ancillary Function Driver for WinSock through crafted socket or AFD-related operations. By carefully controlling allocation, release, and reuse patterns in kernel memory, the exploit attempts to trigger the use-after-free condition and reclaim the freed memory with attacker-influenced data. If the race and memory layout are successful, the attacker corrupts kernel state in a way that grants elevated privileges, commonly by modifying process security context or achieving kernel-mode code execution. The attacker can then spawn a SYSTEM-level shell or service, tamper with endpoint protections, collect credentials, establish persistence, and use the host as a platform for lateral movement. There are no named threat actors or public exploit maturity reported in the supplied data, and the low, flat EPSS trend suggests limited current exploitation probability, but the vulnerability remains valuable as a post-compromise escalation primitive.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-34335 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Because exact fixed build numbers or package versions were not provided, use the Microsoft Security Update Guide and Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch tooling to identify and deploy the applicable June 2026 or later cumulative security update for each supported OS version. Prioritize systems where untrusted users can log on, shared workstations, VDI pools, jump hosts, developer workstations, terminal servers, and servers exposed to broad interactive access. If immediate patching is not possible, reduce risk by limiting local logon rights, enforcing least privilege, blocking execution from user-writable directories where feasible, strengthening application control, ensuring endpoint protection is active, and monitoring for suspicious privilege escalation behavior. There is no reliable configuration-only mitigation that fully removes the kernel vulnerability while preserving normal Winsock functionality.

How to confirm the fix worked

Confirm that all affected Windows systems have installed the Microsoft cumulative security update that supersedes the vulnerable afd.sys version for their OS release. Validate through centralized patch management reports, Windows Update history, installed hotfix inventory, and file-version checks for %SystemRoot%\System32\drivers\afd.sys against Microsoft’s fixed-version metadata. Use vulnerability scanning or authenticated configuration assessment to verify that Windows 10, Windows 11, and Windows Server assets are no longer reporting exposure to CVE-2026-34335. Reboot systems where required, because kernel driver fixes generally do not take effect until the patched driver is loaded. For high-risk systems, perform a post-patch check that afd.sys is loaded from the expected system path, that no vulnerable build remains staged for rollback, and that no unsupported OS version is relying on an unavailable patch path.

Typical attack path

1. Gain initial authenticated access to an affected Windows workstation or server as a low-privileged user.
2. Execute a local exploit binary, script, or malware module that targets afd.sys through Winsock/AFD kernel interfaces.
3. Trigger the use-after-free condition by manipulating socket or AFD object lifetimes and attempting kernel heap grooming.
4. Reuse freed kernel memory with attacker-controlled or attacker-influenced data.
5. Achieve kernel memory corruption sufficient to elevate the current process or spawn a new process as NT AUTHORITY\SYSTEM.
6. Disable defenses, dump credentials, install persistence, or move laterally using the elevated privileges.

How to detect it

There are no supplied public exploit indicators, no reported exploit maturity, and no KEV listing, so detection should focus on behavioral evidence of local privilege escalation rather than fixed network indicators. Review endpoint detection telemetry, Sysmon, Windows Security logs, PowerShell logs, service control events, Windows Error Reporting, crash dumps, and EDR kernel-alert data for signs of exploitation attempts. Look for low-privileged user processes that abruptly spawn SYSTEM-level processes, create or modify services, disable security tooling, dump credentials, or launch shells from user-writable directories. Investigate unexpected afd.sys-related crashes, bugchecks, or application faults shortly before privilege changes, especially when followed by service creation, new scheduled tasks, credential access, or lateral movement. Useful Windows event sources include Security events 4688 for process creation, 4672 for special privileges assigned, 4624 for logon context, 4697 and System 7045 for service installation, 4698 for scheduled task creation, 1102 for audit log clearing, 7036/7031 for service state changes or crashes, and Sysmon events 1, 7, 10, 11, 12-14, and 22 where deployed. Because exploitation is local, network logs are unlikely to show the exploit itself; instead, correlate suspicious privilege escalation on the host with preceding remote access, phishing payload execution, or malware activity.

• afd.sys
• %SystemRoot%\System32\drivers\afd.sys
• C:\Windows\System32\drivers\afd.sys
• \Device\Afd
• Ancillary Function Driver for WinSock
• NT AUTHORITY\SYSTEM
• Event ID 7045
• Event ID 4697
• Event ID 4672
• Event ID 4688
• Event ID 1102
• sc.exe create
• schtasks.exe /create
• wevtutil.exe cl
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} recoveryenabled no
• reg.exe add HKLM\SYSTEM\CurrentControlSet\Services
• powershell.exe -EncodedCommand
• cmd.exe /c whoami /all

What your security team should do

• Prioritize patching on systems that allow interactive or remote user sessions, including VDI, RDS/terminal servers, jump hosts, developer machines, and shared workstations.
• Use centralized inventory to identify all affected Windows 10, Windows 11, and Windows Server versions, including older Server 2012 and Windows 10 1607/1809 systems that may be outside normal patch focus.
• Deploy the applicable Microsoft cumulative security update and verify reboot completion and afd.sys replacement.
• Hunt for recent suspicious local privilege escalation behavior, especially low-privileged processes spawning SYSTEM shells, creating services, or disabling security controls.
• Correlate endpoint alerts involving afd.sys crashes, unusual kernel faults, service creation, credential dumping, and privilege changes from the same host or user session.
• Strengthen least-privilege controls while patching, including removal of unnecessary local administrator rights and restriction of local logon access.
• Apply application control or attack surface reduction rules to prevent execution of untrusted binaries from user-writable paths.
• Maintain heightened monitoring despite the currently low EPSS and absence from KEV, because local privilege escalation vulnerabilities are frequently incorporated into intrusion toolchains after public research becomes available.