CVE-2026-45596

What it actually does

CVE-2026-45596 is a local privilege escalation flaw in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. The issue is a use-after-free condition reachable by a low-privileged, authorized local attacker. By winning a race condition and causing the kernel driver to operate on freed memory, an attacker may be able to corrupt kernel memory and execute code with elevated privileges. Successful exploitation can provide high-impact compromise of confidentiality, integrity, and availability because the attacker can move from a standard user context to kernel-level or SYSTEM-level control. The CVSS vector indicates local access, low privileges, no user interaction, and high attack complexity, meaning exploitation likely requires precise timing and a reliable exploit primitive rather than a simple command-line trigger.

Why it matters to the business

This vulnerability can turn an initial low-privilege foothold on a Windows workstation or server into full local control. In business terms, it increases the damage from phishing, stolen credentials, malware execution, or compromise of a low-privileged account because the attacker can potentially disable security tools, access sensitive data, install persistence, tamper with logs, or move laterally using elevated privileges. The affected product range includes many supported Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server releases, so enterprise exposure may be broad. It is not currently listed in CISA KEV, is not identified as ransomware-used, has low EPSS, and has no reported public exploit maturity in the supplied data, so priority should be driven by normal patch cadence plus higher urgency for servers, shared workstations, privileged access workstations, VDI, and systems where untrusted users can log on.

How an attack unfolds

An attacker must already have local code execution or an authenticated local session on an affected Windows system. They then run a purpose-built exploit that interacts with the Windows networking stack through the Ancillary Function Driver for WinSock. The exploit attempts to trigger a race condition that causes the driver to free an object while another operation can still reference it. If the attacker reliably controls the freed memory region before reuse, they may manipulate kernel execution or kernel data structures to elevate privileges. After escalation, the attacker typically launches a SYSTEM-level shell or injects into a privileged process, disables defenses, dumps credentials, installs persistence, or uses the host as a staging point for lateral movement. Because the attack complexity is high and no public exploit maturity is reported, failed attempts may crash the host or produce instability rather than clean privilege escalation.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45596 for all affected Windows versions. Because no exact fixed build numbers were provided in the input, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the June 2026 or later cumulative security update applicable to each affected platform. Prioritize Windows servers, systems with multiple interactive users, remote desktop hosts, VDI pools, privileged access workstations, domain administration workstations, and endpoints where endpoint protection has detected prior suspicious activity. If immediate patching is not possible, reduce exposure by limiting local logon rights, restricting RDP and interactive access, enforcing least privilege, blocking untrusted code execution through application control, ensuring EDR tamper protection is enabled, and monitoring for local privilege escalation behavior. There is no safe configuration-only workaround that should be considered equivalent to patching for a kernel use-after-free vulnerability.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows assets have installed the relevant Microsoft cumulative security update released on or after the publication date. Use enterprise patch management reporting, Windows Update history, and PowerShell inventory such as Get-HotFix or WMI/CIM queries for installed hotfixes and OS build numbers. Validate that the afd.sys driver version and timestamp align with the patched Windows build for the specific operating system release. Conduct authenticated vulnerability scanning after patch deployment to confirm the CVE is no longer reported. For high-risk systems, reboot after patching and verify the new kernel driver is loaded, since kernel driver updates may not be fully effective until restart. Also confirm that compensating controls remain in place: non-administrative users should not have unnecessary local logon rights, endpoint protection should be active, and application control policies should prevent execution from user-writable directories where feasible.

Typical attack path

1. Gain initial local access through phishing, malware execution, stolen credentials, remote access abuse, or exploitation of a separate vulnerability.
2. Confirm the target is an affected Windows client or server build and that the system has not received the relevant security update.
3. Run a local exploit that exercises the Ancillary Function Driver for WinSock and attempts to win the use-after-free race condition.
4. Manipulate freed kernel memory to gain elevated privileges, typically SYSTEM or kernel-level execution.
5. Spawn or inject into a privileged process to execute attacker tooling with elevated rights.
6. Disable or tamper with endpoint security, collect credentials or tokens, and establish persistence.
7. Use elevated access to access sensitive data, alter system configuration, or move laterally to other systems.

How to detect it

There are no unique public indicators of compromise or known threat actor procedures in the supplied data, and the issue is not reported as exploited in the wild. Detection should therefore focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs, Sysmon, EDR process lineage, kernel crash telemetry, and endpoint protection events on affected or previously unpatched systems. Look for low-privileged user processes spawning SYSTEM-level shells or administrative tools, sudden integrity-level changes, unexpected service creation, suspicious driver or kernel-related errors, and endpoint security tampering shortly after execution from user-writable paths. Useful Windows logs include Security Event ID 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for logon context, 7045 in the System log for new service installation, PowerShell Operational logs for post-escalation commands, and Sysmon Event IDs 1, 7, 10, 11, and 12-14 where available. Also examine Windows Error Reporting, System bugcheck events, and crash dumps for afd.sys involvement, as unreliable exploitation of a kernel race condition may cause crashes. Because afd.sys is a legitimate Windows driver, its presence alone is not evidence of compromise; correlate any artifacts with suspicious process ancestry, timestamps, privilege transitions, and security control changes.

What your security team should do

• Inventory all affected Windows 10, Windows 11, and Windows Server systems and map them to patch status.
• Prioritize patching for internet-adjacent management hosts, RDP/VDI servers, shared servers, privileged access workstations, and systems used by administrators.
• Deploy the applicable Microsoft cumulative security updates and require reboot validation where necessary.
• Run authenticated vulnerability scans or patch compliance checks to confirm the issue is remediated across affected OS versions.
• Hunt for suspicious local privilege escalation behavior on unpatched systems, especially user-launched processes that quickly become SYSTEM or spawn privileged command interpreters.
• Review endpoint telemetry for crashes or instability involving afd.sys, unexpected kernel bugchecks, or unusual process activity immediately before host crashes.
• Restrict local interactive access, RDP access, and code execution rights for standard users until patching is complete.
• Ensure EDR, tamper protection, credential theft protection, and attack surface reduction rules are enabled on high-value Windows systems.
• Monitor threat intelligence and Microsoft advisories for changes in exploit maturity, KEV status, or evidence of in-the-wild exploitation.