CVE-2026-42911

What it actually does

CVE-2026-42911 is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock, afd.sys. The flaw is a use-after-free condition: kernel memory associated with a networking-related object can be freed while it is still reachable, allowing a low-privileged local attacker to corrupt or reuse that memory in a controlled way. Successful exploitation can allow code execution in kernel context or equivalent privilege escalation to NT AUTHORITY\SYSTEM, giving the attacker full control of the affected Windows host. The CVSS vector indicates local access, low privileges required, no user interaction, high attack complexity, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, an attacker who already has a foothold on a Windows workstation or server could gain full administrative control of that system, disable security tooling, dump credentials, move laterally, tamper with business data, or deploy malware. This vulnerability affects a broad range of supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025, so enterprise exposure can be widespread. Current exploitation signals are comparatively low: EPSS is 0.00234 and stable over 30 days, there is no known CISA KEV listing, no ransomware association, and no public exploit maturity reported; however, local privilege escalation flaws are commonly used after phishing, credential theft, or application compromise to turn limited access into full host compromise.

How an attack unfolds

An attacker must first obtain the ability to execute code locally as a non-administrative user on an affected Windows system. This initial access may come from phishing, stolen credentials, exploitation of another application, abuse of remote access, or execution under a low-privileged service account. The attacker then runs a purpose-built exploit that interacts with Windows networking interfaces backed by the Ancillary Function Driver for WinSock. By carefully manipulating object allocation, release, and reuse timing, the exploit attempts to trigger the use-after-free condition in afd.sys. If the attacker can shape the freed kernel memory successfully, they can redirect execution or modify privileged kernel structures, commonly to elevate the current process token to SYSTEM. Once elevated, the attacker can install persistence, access protected files, dump credentials, disable endpoint controls, create accounts, or use the host as a staging point for lateral movement.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42911 for every affected Windows version. Because no per-product fixed build numbers were provided in the input, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch management tooling to deploy the June 2026 or later cumulative update applicable to each OS release. Prioritize internet-facing servers, shared servers, privileged access workstations, jump hosts, VDI images, developer workstations, and systems where untrusted users can log on. Where immediate patching is not possible, reduce risk by restricting interactive logon and RDP access, limiting local user rights, enforcing application control, monitoring for suspicious local privilege escalation behavior, and ensuring endpoint protection tamper protection is enabled. Mitigations should be treated as temporary because the flaw is in a Windows kernel driver and cannot be fully neutralized through configuration alone.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative security update that includes the fix for CVE-2026-42911. Use centralized patch compliance reporting from WSUS, Microsoft Configuration Manager, Intune, Windows Update for Business, vulnerability scanners, or EDR asset inventory. Validate that Windows 10, Windows 11, and Windows Server assets listed as affected are no longer reporting the CVE as applicable. On representative systems, confirm OS build and installed hotfix history using supported administrative tooling such as Settings > Windows Update > Update history, Control Panel update history, PowerShell Get-HotFix, DISM package inventory, or enterprise patch inventory. For golden images, VDI pools, offline templates, and server images, confirm the fixed cumulative update has been injected or installed before redeployment. If compensating controls are used temporarily, validate that non-administrative users cannot execute unapproved binaries and that local logon/RDP access is restricted to authorized users only.

Typical attack path

1. Gain local code execution on an affected Windows workstation or server as a low-privileged user.
2. Confirm the system is running an affected Windows version and lacks the relevant Microsoft security update.
3. Execute a local exploit that interacts with WinSock/AFD-related kernel functionality.
4. Trigger the afd.sys use-after-free condition through controlled object lifetime and memory-reuse behavior.
5. Achieve kernel-level code execution or modify the current process token to gain SYSTEM privileges.
6. Use elevated privileges to disable defenses, collect credentials, persist, access sensitive data, or move laterally.

How to detect it

There are no public, unique indicators of compromise provided for this vulnerability, and local kernel privilege escalation often leaves limited application-layer evidence. Detection should focus on behavioral evidence of post-exploitation privilege escalation. Review EDR telemetry, Sysmon, Windows Security logs, PowerShell logs, service creation logs, driver load events, and endpoint protection alerts around the time a low-privileged user account unexpectedly gained administrative or SYSTEM-level execution. Look for suspicious processes launched from user-writable directories that subsequently create SYSTEM child processes, spawn command shells, add local administrators, disable security products, dump LSASS memory, create new services, or alter persistence locations. Relevant Windows events include successful logons, special privilege assignment, process creation if enabled, service installation, scheduled task creation, local group membership changes, audit policy changes, and security product tampering. Because exploitation targets afd.sys, crashes or bugchecks involving afd.sys near suspicious user activity may be useful leads, but they are not proof of exploitation. Correlate local privilege escalation indicators with earlier initial-access events such as phishing payload execution, suspicious remote logons, browser-delivered malware, or exploitation of another service.

What your security team should do

• Patch affected Windows clients and servers with the applicable Microsoft cumulative security update, prioritizing high-value systems and systems that allow multiple users to log on interactively.
• Use vulnerability management tooling to identify all Windows 10, Windows 11, and Windows Server 2012/2016/2019/2022/2025 assets still reporting this issue.
• Treat this primarily as a post-compromise privilege escalation risk: review controls around phishing resistance, endpoint detection, application control, and least privilege.
• Harden local access paths by limiting RDP, removing unnecessary local users, enforcing MFA for remote access, and restricting service accounts from interactive logon.
• Monitor for suspicious privilege escalation behavior, especially low-privileged processes spawning SYSTEM shells or modifying security tooling after local execution.
• Review EDR alerts for token manipulation, suspicious handle activity, unexpected child processes from user-writable paths, and tampering with Microsoft Defender or third-party endpoint agents.
• Ensure backup, recovery, and incident response procedures account for rapid containment of Windows hosts where local privilege escalation is suspected.
• Track Microsoft advisories and threat intelligence for any change in exploit maturity, KEV status, EPSS movement, or emergence of public exploit code.