CVE-2026-35416

What it actually does

This vulnerability is a local elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. The issue is a type confusion memory-corruption bug where the kernel driver can access a resource using an incompatible object type. A local authenticated attacker who can run code on an affected Windows system may be able to manipulate driver interactions to corrupt kernel memory and execute code with elevated privileges, potentially gaining NT AUTHORITY\SYSTEM-level control. The CVSS vector indicates local access, low privileges required, no user interaction, high complexity, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can turn an initial low-privilege foothold on a workstation or server into full local system compromise. This can allow attackers to disable security tooling, dump credentials, tamper with data, install persistence, move laterally, or deploy follow-on malware. Because the affected product set spans many supported Windows client and server versions, exposure may be broad across enterprise fleets. The vulnerability is not currently listed in CISA KEV, is not marked as ransomware-used, has low EPSS, and has no known public exploit maturity, but privilege-escalation flaws in Windows kernel drivers are commonly valuable for post-compromise operations and should be patched through normal priority vulnerability management, with faster action on internet-facing, high-value, shared, or administrator-accessible systems.

How an attack unfolds

An attacker first needs local code execution or an authenticated local session on an affected Windows host, such as through phishing, stolen credentials, exploitation of another vulnerability, or malware already running as a standard user. The attacker then runs exploit code that interacts with the Windows Ancillary Function Driver for WinSock through supported local interfaces. By supplying crafted inputs that trigger the type confusion condition, the attacker attempts to corrupt kernel memory in a controlled way. If exploitation succeeds, the attacker transitions from a low-privilege user context to elevated kernel-mediated privileges, typically resulting in SYSTEM-level execution. From there, they can execute privileged commands, disable defenses, access protected credentials and files, create persistent services or scheduled tasks, and use the compromised system as a launch point for lateral movement. Because the attack complexity is rated high and exploit maturity is currently listed as none, reliable exploitation may require precise knowledge of the target OS build and memory state, but defenders should assume this class of flaw may become more practical if weaponized exploit code is later released.

How to fix it

Apply the Microsoft security update or cumulative update that fixes this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 where applicable. Because no per-product fixed build numbers were provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the applicable update released for this CVE and verify the system is on a patched cumulative update level. Prioritize servers, shared workstations, administrative jump hosts, domain infrastructure, virtualization hosts, and systems where untrusted users can log on interactively. If immediate patching is not possible, reduce exposure by limiting local logon rights, removing unnecessary user access, enforcing least privilege, applying application control to block unapproved executables, ensuring EDR tamper protection is enabled, and monitoring for suspicious local privilege-escalation behavior. There is no safe configuration-only mitigation that should be considered equivalent to patching the kernel driver flaw.

How to confirm the fix worked

Confirm remediation by checking that each affected Windows endpoint has installed the Microsoft cumulative/security update containing the fix and that the OS build level matches or exceeds Microsoft’s patched build for the relevant Windows release. Validate through centralized patch management compliance, Windows Update history, installed hotfix inventory, endpoint management reports, or vulnerability scanner plugin results for CVE-2026-35416. On representative systems, verify the AFD driver file version and timestamp correspond to the patched Microsoft release. Re-run authenticated vulnerability scans after patch deployment and confirm the vulnerability no longer appears. For systems that could not be patched, validate compensating controls by confirming local logon restrictions, application control policies, EDR health, and alerting coverage for suspicious privilege escalation attempts.

Typical attack path

1. Gain initial access to an affected Windows workstation or server using stolen credentials, malware, phishing, or another vulnerability.
2. Establish the ability to run code locally as a low-privilege authenticated user.
3. Identify the Windows version/build and confirm the target is unpatched for the Ancillary Function Driver for WinSock vulnerability.
4. Run local exploit code that sends crafted operations to the AFD/WinSock kernel driver interface.
5. Trigger the type confusion condition and corrupt kernel memory in a way that changes execution context or token privileges.
6. Obtain elevated local privileges, commonly SYSTEM-level execution.
7. Use elevated access to disable security controls, dump credentials, install persistence, tamper with data, or move laterally.

How to detect it

This vulnerability is a local privilege-escalation issue, so exploitation may not generate obvious network indicators. Focus detection on endpoint telemetry, Windows security logs, EDR process lineage, kernel crash artifacts, and patch status. Review events where a non-administrative user process spawns a SYSTEM-level process, creates a service, modifies security tooling, accesses LSASS, or performs privileged operations shortly after execution of an unusual binary. Correlate suspicious behavior with accesses to the AFD device interface where EDR exposes driver or device interaction telemetry. Investigate Windows Error Reporting, memory dumps, and System event logs for crashes or bugchecks referencing afd.sys, especially if followed by successful elevated execution. Hunt for new or unusual scheduled tasks, services, startup entries, security tool tampering, credential dumping attempts, and unexpected administrative group membership changes. Since there are no known public exploit indicators and EPSS is currently low, absence of known IOCs does not prove absence of exploitation; behavioral analysis and patch compliance are the most reliable approaches.

• C:\Windows\System32\drivers\afd.sys
• \Device\Afd
• afd.sys
• Ancillary Function Driver for Winsock
• BugCheck
• Windows Error Reporting
• NT AUTHORITY\SYSTEM
• sc.exe create
• schtasks.exe /create
• net localgroup administrators
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump

What your security team should do

• Deploy the applicable Microsoft security or cumulative update across affected Windows clients and servers, prioritizing high-value systems and systems with broad user access.
• Use endpoint and vulnerability management tooling to inventory all affected Windows versions and track patch compliance to closure.
• Hunt for signs of local privilege escalation around the publication date and afterward, especially on systems where low-privilege users or service accounts can execute code.
• Review EDR alerts for suspicious token manipulation, unexpected SYSTEM shells, driver-related exploitation behavior, or processes that rapidly transition from low privilege to SYSTEM.
• Restrict local interactive logon rights and remove unnecessary administrator-equivalent permissions from standard users and service accounts.
• Enforce application control or allowlisting to reduce the chance that untrusted local exploit binaries can execute.
• Ensure credential protections are enabled, including LSASS protection where feasible, to reduce post-exploitation impact if SYSTEM privileges are obtained.
• Monitor Microsoft advisories for updated exploitability assessment, fixed build details, or evidence of in-the-wild exploitation, since exploit maturity can change after disclosure.