CVE-2026-41088

What it actually does

CVE-2026-41088 is a local privilege-escalation vulnerability in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. The flaw is a type-confusion condition, where the driver can access a resource as the wrong internal object type. Because AFD operates in the Windows kernel and services networking-related system calls for user-mode processes, a low-privileged authenticated attacker who can run code locally may be able to trigger the bug and corrupt kernel memory. Successful exploitation can elevate the attacker from a standard user context to high-integrity or SYSTEM-level privileges, giving control over confidentiality, integrity, and availability of the affected host. This is not a remote network entry vulnerability by itself; the attacker first needs local code execution or valid low-privileged access.

Why it matters to the business

If exploited, this vulnerability can turn an initial foothold on a Windows workstation or server into full administrative control of that machine. That can enable credential theft, disabling of security tools, persistence installation, lateral movement, ransomware staging, or tampering with business-critical systems. The issue affects widely deployed Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 versions, so exposure can be broad in enterprises. Current public exploitation signals are low: it is not listed in CISA KEV, is not reported as ransomware-used, has low EPSS at 0.00319 with a flat 30-day trend, and no public exploit maturity is indicated. Even so, local privilege-escalation bugs in Windows kernel drivers are commonly chained with phishing, malware loaders, stolen credentials, or browser/document exploits, so patching should remain a standard endpoint and server hardening priority.

How an attack unfolds

An attacker begins with authenticated local access to an affected Windows system, typically through malware execution, a compromised low-privileged account, abuse of remote access, or a separate initial-access vulnerability. The attacker then runs a purpose-built program that interacts with the Windows networking stack and sends crafted requests to the Ancillary Function Driver for WinSock. The malicious input causes the kernel driver to treat an object or memory resource as an incompatible type. If the attacker can shape the resulting memory corruption reliably, they may redirect kernel execution or modify privileged kernel data structures, such as those controlling process tokens or privileges. After successful exploitation, the attacker gains elevated local privileges, commonly SYSTEM, and can then dump credentials, disable defenses, install persistence, access protected files, move laterally, or deploy additional payloads. Failed exploitation may produce application crashes, system instability, or bug checks referencing afd.sys, but successful exploitation may leave few direct traces beyond the attacker’s post-exploitation activity.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-41088 for all affected Windows versions: Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, and 26H1, Windows Server 2022 including 23H2, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to identify the applicable cumulative update for the affected OS release. Because the vulnerable component is a kernel driver, mitigation without patching is limited; do not attempt to remove or disable the AFD driver on production systems, as it is required for core Windows networking functionality. Where immediate patching is not possible, reduce risk by limiting interactive logon rights, restricting RDP and remote administration access, enforcing least privilege, blocking untrusted executable content, enabling application control, maintaining EDR coverage, and prioritizing systems where untrusted users can execute code such as workstations, jump hosts, developer systems, VDI, RDS hosts, and multi-user servers.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the Microsoft cumulative security update that includes the fix for CVE-2026-41088. Use enterprise patch inventory, Windows Update history, WSUS/Configuration Manager/Intune compliance reporting, or PowerShell-based checks such as Get-HotFix and OS build inventory to confirm the relevant post-fix update is present. Where file-version validation is used, verify the version and signing timestamp of C:\Windows\System32\drivers\afd.sys against Microsoft’s published fixed-file information for the specific OS build. Validate that systems have rebooted after patch installation, because kernel driver fixes generally require a restart to take effect. Exposure checks should include all listed Windows client and server versions, including offline images, golden images, VDI pools, templates, and server baselines. If no matching security update is installed or the afd.sys version predates Microsoft’s fixed version for that OS line, treat the host as exposed.

Typical attack path

1. Gain local code execution or authenticate as a low-privileged user on an affected Windows system.
2. Run a local exploit program that opens or interacts with Windows networking interfaces handled by the Ancillary Function Driver for WinSock.
3. Send crafted parameters or I/O control requests that trigger the type-confusion condition in the kernel driver.
4. Use the resulting kernel memory corruption to alter privileges or execute attacker-controlled logic in kernel context.
5. Spawn or modify a process to run with elevated privileges, typically SYSTEM.
6. Disable security controls, access protected data, dump credentials, establish persistence, or use the host for lateral movement.

How to detect it

Detection should focus on both attempted kernel exploitation and the post-exploitation behavior that follows privilege escalation. Collect and review Windows Security logs, Sysmon or EDR telemetry, PowerShell logs, service-control events, process creation logs, crash dumps, Windows Error Reporting data, and system bug-check events. Look for low-privileged user processes that unexpectedly create SYSTEM-level child processes, install services, modify scheduled tasks, access LSASS, disable Defender or EDR components, add local administrators, or execute credential-dumping tools. For exploit-attempt artifacts, search for system crashes or dump files referencing afd.sys, especially on unpatched systems and around the time suspicious local binaries executed. Useful Windows events include Security 4688 for process creation, 4672 for special privileges assigned to a new logon, 7045 for new service installation, 4697 for service installation where enabled, 4698 for scheduled task creation, 4720 and 4732 for local user/group changes, and Defender/EDR tamper alerts. Because there are no public exploit indicators or known threat actors reported for this CVE in the provided intelligence, there are no reliable universal network signatures or file hashes; behavioral correlation is required. Treat afd.sys crashes as leads, not proof, because legitimate driver or networking faults can generate similar artifacts.

• C:\Windows\System32\drivers\afd.sys
• afd.sys
• AFD.sys
• BugCheck
• 0x0000003B
• 0x00000050
• 0x000000D1
• Event ID 7045
• Event ID 4697
• Event ID 4698
• Event ID 4672
• Event ID 4688
• sc.exe create
• net localgroup administrators
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} safeboot
• powershell.exe -ExecutionPolicy Bypass
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• C:\Windows\MEMORY.DMP
• C:\Windows\Minidump\

What your security team should do

• Patch affected Windows endpoints and servers through the appropriate Microsoft cumulative update, prioritizing internet-adjacent administration hosts, RDS/VDI platforms, developer workstations, privileged-access workstations, and systems used by multiple users.
• Validate patch compliance with centralized inventory and require reboot confirmation, since kernel-driver updates may not be active until restart.
• Hunt for suspicious privilege escalation patterns, especially low-privileged processes spawning SYSTEM shells, unexpected service creation, security-tool tampering, credential dumping, or rapid privilege changes after local process execution.
• Restrict local administrator membership, interactive logon rights, and remote access pathways to reduce the value of local privilege escalation.
• Use application control, attack surface reduction rules, EDR, and script-blocking policies to prevent or detect untrusted local exploit binaries from running.
• Review crash telemetry for afd.sys-related bug checks or unusual kernel faults, particularly on unpatched systems, while recognizing that crashes are not required for successful exploitation.
• Prioritize remediation according to business exposure rather than EPSS alone: although EPSS is low and the issue is not in KEV, Windows local privilege-escalation vulnerabilities are valuable as part of multi-stage intrusions.