CVE-2026-45601

What it actually does

This vulnerability is a local elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. The issue is described as a use-after-free condition caused by a race condition, meaning a low-privileged local attacker can attempt to manipulate timing around kernel objects after they have been freed. If exploitation succeeds, the attacker can corrupt kernel memory and execute code with elevated privileges, typically reaching NT AUTHORITY\SYSTEM. The vulnerability requires local access and prior authorization, has high attack complexity, and does not require user interaction, but successful exploitation can compromise confidentiality, integrity, and availability of the affected Windows host.

Why it matters to the business

An attacker who already has a foothold on a vulnerable Windows workstation or server could use this flaw to gain full control of that machine, disable security tools, access sensitive data, install persistence, and move laterally. This is especially relevant for endpoint and server hardening because local privilege escalation vulnerabilities are often chained after phishing, credential theft, exposed remote access, or exploitation of another application. The CVE is not currently listed in CISA KEV, is not marked as used in ransomware campaigns, has no known public exploit maturity, and has a low EPSS score, so immediate mass exploitation appears unlikely; however, the broad Windows client and server impact makes timely patching important across enterprise fleets.

How an attack unfolds

An attacker must first obtain the ability to run code as a low-privileged authenticated user on an affected Windows system. They then interact with Windows networking primitives exposed through the Ancillary Function Driver for WinSock and attempt to trigger a race condition that causes a kernel object to be freed while still being referenced. By carefully controlling timing and memory reuse, the attacker attempts to replace or influence the freed memory with attacker-controlled data. If successful, the exploit can corrupt kernel execution flow or security-relevant kernel structures, allowing the attacker to elevate from a standard user context to SYSTEM. After elevation, the attacker can perform post-exploitation actions such as dumping credentials, creating services, tampering with endpoint defenses, adding local administrators, or using the host as a pivot point.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including supported Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 releases. No exact fixed build or package versions were provided in the input, so use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to identify and deploy the applicable cumulative security update for each affected operating system version. Prioritize internet-facing servers, shared workstations, administrative workstations, jump hosts, VDI images, and systems where untrusted users can execute code. Where immediate patching is not possible, reduce risk by enforcing least privilege, restricting interactive logon, blocking execution from user-writable directories where feasible, enabling attack surface reduction rules, maintaining EDR coverage, and monitoring for suspicious local privilege-escalation behavior. There is no practical configuration-only mitigation that should be treated as equivalent to patching.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the relevant Microsoft cumulative security update released to fix this vulnerability. Use centralized patch inventory, vulnerability scanning, Windows Update history, installed hotfix inventory, and OS build-number validation against the Microsoft Security Update Guide. Validate that golden images, offline images, VDI templates, and server baselines have also been updated so vulnerable systems are not reintroduced. If scanners still report exposure after patching, confirm the scanner plugin is current and that it is checking the installed cumulative update or fixed OS build rather than only the product family. For high-value systems, perform authenticated scanning and compare results with local commands such as update history, installed KB inventory, and OS build reporting.

Typical attack path

1. Gain initial local code execution on an affected Windows workstation or server as a low-privileged authenticated user.
2. Run a local exploit that interacts with WinSock/AFD kernel functionality.
3. Trigger the race condition repeatedly to cause use-after-free behavior in the Windows Ancillary Function Driver for WinSock.
4. Manipulate kernel memory reuse to obtain elevated execution or modify security-relevant kernel state.
5. Spawn a SYSTEM-level process or inject into an elevated process.
6. Use elevated privileges for credential access, persistence, defense evasion, lateral movement, or data access.

How to detect it

There are no known public, vulnerability-specific indicators of compromise for this issue, and it is not currently listed as exploited in CISA KEV. Detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs, Sysmon or EDR telemetry, service-control events, process creation telemetry, crash dumps, and endpoint alerts around the time a low-privileged process unexpectedly gained SYSTEM-level execution. Useful sources include Security Event IDs 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for logon context, 4697 for service installation, System Event ID 7045 for new service creation, PowerShell logs for suspicious script execution, and EDR events showing token manipulation, process injection, LSASS access, or defense evasion. Kernel instability or bugchecks referencing afd.sys shortly before suspicious SYSTEM activity may be relevant but is not conclusive. Investigators should look for an initial low-privileged process spawning or dropping an unknown local binary, followed by an elevated child process, new administrator membership, credential dumping, or disabling of security services. Because exploitation requires local code execution, correlate any suspected privilege escalation with preceding phishing payloads, remote access tool execution, web shell activity, RDP/VPN logons, or application compromise.

What your security team should do

• Patch affected Windows clients and servers through the standard emergency or accelerated monthly security update process, prioritizing systems with interactive users, shared access, administrative use, or high business criticality.
• Use authenticated vulnerability scanning or endpoint inventory to identify all affected Windows 10, Windows 11, and Windows Server versions still missing the applicable cumulative update.
• Review recent endpoint detections for suspicious local privilege escalation followed by SYSTEM-level process creation, credential dumping, new service creation, or security tool tampering.
• Harden endpoints by limiting standard users' ability to execute untrusted binaries and scripts, especially from temporary, downloads, profile, and other user-writable paths.
• Ensure EDR, Sysmon or equivalent telemetry, Windows Security logging, PowerShell logging, and service-creation auditing are enabled on high-value Windows systems.
• Monitor for exploit chaining: initial access events followed shortly by privilege escalation, credential access, lateral movement, or persistence.
• Track Microsoft guidance for any revised fixed build information, exploitability assessment changes, or out-of-band advisories related to this vulnerability.