CVE-2026-34345

What it actually does

This vulnerability is a local privilege-escalation flaw in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. A low-privileged authenticated user can trigger a type-confusion memory-corruption condition in kernel-mode code, potentially causing the driver to treat one resource type as another incompatible type. Successful exploitation can allow code execution in the Windows kernel security context, enabling the attacker to obtain SYSTEM-level privileges, bypass user-mode security boundaries, tamper with protected processes, disable security tooling, access sensitive data, or install persistent kernel-adjacent components. The CVSS vector indicates local access, low privileges required, no user interaction, high complexity, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited after an attacker already has local access to a Windows workstation or server, this flaw can turn a limited foothold into full control of the affected system. That can materially increase the impact of phishing, stolen credentials, malware execution, or compromise of a low-privileged service account by enabling credential theft, lateral movement, security-tool disabling, data access, and ransomware staging. The vulnerability affects many supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025, so organizations with broad Windows estates should treat patching as an important hardening priority. However, current signals show low EPSS, no known KEV listing, no known ransomware association, and no reported exploit maturity in the supplied data, so this is less urgent than actively exploited Windows privilege-escalation vulnerabilities but should still be remediated through normal accelerated patch cycles.

How an attack unfolds

An attacker first needs some form of local code execution on an affected Windows system, such as access through compromised credentials, malware delivered by phishing, abuse of a vulnerable application, or command execution as a low-privileged user. The attacker then runs exploit code that interacts with Windows networking/WinSock kernel interfaces exposed through the Ancillary Function Driver. By carefully shaping calls and kernel objects, the exploit attempts to trigger a type-confusion condition where afd.sys accesses a resource using an incompatible type. If the attacker reliably controls the resulting memory-corruption primitive, they can manipulate kernel memory to elevate the current process token or otherwise gain SYSTEM-level execution. After privilege escalation, the attacker commonly performs post-exploitation actions such as dumping credentials, disabling endpoint protection, creating privileged accounts or services, modifying firewall/security settings, moving laterally, or deploying additional payloads. Because the attack is local and high-complexity, exploitation is most valuable as a second-stage capability after initial access rather than as an internet-facing entry point.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions in scope, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to identify and deploy the relevant cumulative update for each OS release. Prioritize systems where local compromise would have high impact, including domain controllers, virtualization hosts, jump servers, management servers, remote access infrastructure, developer workstations, and endpoints used by privileged administrators. Where immediate patching is not possible, reduce exposure by enforcing least privilege, removing unnecessary local administrator rights, restricting interactive logon to servers, hardening endpoint detection and response tamper protection, blocking untrusted executable content, and monitoring for suspicious local privilege-escalation behavior. There is generally no safe configuration-only mitigation for a kernel memory-corruption issue in a core Windows driver; patching is the primary remediation.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative security update that includes the fix for this vulnerability. Use centralized patch/compliance tooling, Windows Update history, WSUS/SCCM/Intune compliance reports, or PowerShell inventory to validate OS build and installed hotfix state across Windows 10, Windows 11, and Windows Server assets. Confirm that afd.sys has been updated as part of the applicable cumulative update and that systems have rebooted successfully where required, because kernel driver fixes do not fully take effect until reboot. Validate that unsupported or out-of-servicing Windows releases are upgraded to supported releases or otherwise isolated. For exposure checks, inventory all affected OS versions and prioritize any system missing the relevant May 2026-or-later security update, or the specific cumulative update identified by Microsoft for the installed Windows release.

Typical attack path

1. Gain initial local execution on an affected Windows endpoint or server using phishing, stolen credentials, malware, an exposed service, or another vulnerability.
2. Run code as a low-privileged authenticated user on the target system.
3. Invoke Windows WinSock/AFD-related kernel interfaces with specially crafted inputs intended to trigger the type-confusion condition in afd.sys.
4. Exploit the resulting kernel memory corruption to modify process privileges, access tokens, or related kernel structures.
5. Obtain SYSTEM-level privileges or equivalent local administrative control.
6. Disable or tamper with security controls, collect credentials, access sensitive files, establish persistence, or use the system as a pivot point for lateral movement.

How to detect it

There are no unique network indicators for this vulnerability because exploitation is local and occurs through Windows kernel driver interfaces. Detection should focus on behavioral evidence of privilege escalation and post-exploitation. Relevant log sources include EDR telemetry, Windows Security logs, Sysmon logs, PowerShell logs, Windows Defender/antivirus events, service-control logs, scheduled task logs, process creation telemetry, LSASS access telemetry, and system crash/minidump records. Hunt for low-privileged users spawning processes that quickly obtain SYSTEM privileges, unexpected service creation, suspicious driver or kernel exploit activity, abnormal access to LSASS, token manipulation alerts, security control tampering, and new persistence mechanisms created shortly after an untrusted executable runs. Review Windows Event ID 4688 for suspicious process creation, 4672 for special privileges assigned to a new logon, 7045 for new service installation, 4698 for scheduled task creation, 1102 for audit log clearing, and Defender/EDR events showing tamper attempts or credential dumping. Kernel memory-corruption attempts may also produce bugchecks or system instability, so correlate unexplained crashes involving networking, afd.sys, or kernel memory faults with preceding suspicious user activity. Because no public exploit maturity or threat actors were provided, detection should rely on generic local privilege-escalation and post-compromise analytics rather than signature-only matching.

What your security team should do

• Inventory all Windows client and server systems matching the affected versions and identify those missing the Microsoft security update that remediates this flaw.
• Prioritize patching of domain controllers, administrative workstations, remote access servers, management infrastructure, internet-adjacent Windows servers, and systems used by privileged users.
• Use centralized deployment tooling to install the applicable cumulative updates and enforce reboot completion where required.
• Hunt for evidence of local privilege escalation on high-value Windows systems, especially suspicious transitions from low-privileged user activity to SYSTEM-level process execution.
• Review EDR alerts for kernel exploit behavior, token manipulation, security-tool tampering, suspicious service creation, credential dumping, or unexpected child processes spawned with SYSTEM privileges.
• Reduce blast radius by limiting local administrator rights, enforcing application control, enabling credential protections, and restricting interactive logon to servers.
• Track Microsoft advisories for exact fixed build information, known issues, and any change in exploitability assessment, KEV status, or public exploit availability.
• Treat new public proof-of-concept code or inclusion in exploitation frameworks as a trigger to accelerate remediation and expand threat hunting.