CVE-2026-45638

What it actually does

CVE-2026-45638 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Ancillary Function Driver for WinSock, commonly implemented by afd.sys. An attacker who already has valid local code execution with low privileges can trigger unsafe memory reuse in the kernel-mode networking driver and potentially execute code in kernel context. Successful exploitation can grant SYSTEM-level privileges, allowing full control over the affected Windows host, including access to protected files, credential material, security controls, and other users' processes. The vulnerability is local-only, requires prior authentication or execution as a low-privileged user, does not require user interaction, and affects multiple Windows client and server versions.

Why it matters to the business

If exploited, this flaw can turn an initial low-privileged compromise into full administrative control of a Windows workstation or server. In business terms, it increases the damage from phishing, stolen credentials, malicious insiders, exposed remote access, or malware that initially lands without administrator rights. Compromise of servers can lead to service disruption, credential theft, lateral movement, disabling of endpoint defenses, ransomware staging, and data exposure. The CVSS score is high, but the current EPSS score is low, it is not listed in CISA KEV, and no exploit maturity is reported, so broad emergency response is less indicated than timely patching and focused monitoring of high-value systems.

How an attack unfolds

An attacker first needs a foothold on an affected Windows system as an authenticated local user or by running code through another vulnerability, malware, remote access session, or compromised account. From that position, the attacker interacts with Windows networking interfaces handled by the Ancillary Function Driver for WinSock. By issuing a crafted sequence of operations that manipulates object lifetime in the driver, the attacker attempts to trigger a use-after-free condition, causing the kernel to reference memory after it has been freed and potentially reallocated with attacker-controlled content. If exploitation is reliable, the attacker can corrupt kernel memory or control execution flow to run code with SYSTEM privileges. After elevation, the attacker typically disables security tools, dumps credentials, installs persistence, accesses sensitive data, or uses the host as a pivot point to reach other systems. There are currently no reported public exploit details, no known KEV listing, and no named threat actor activity provided for this vulnerability, so defenders should prioritize patch coverage and behavioral detection rather than relying on fixed exploit signatures.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45638 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no fixed build numbers were provided in the input, use Microsoft Update, Windows Update for Business, WSUS, Configuration Manager, or the Microsoft Update Catalog to deploy the latest cumulative update applicable to each supported OS release. Prioritize domain controllers, virtualization hosts, jump servers, RDS/VDI hosts, internet-facing Windows servers, developer workstations, and systems used by privileged administrators. There is no safe configuration-only workaround that fully removes the local kernel attack surface while preserving normal Windows networking functionality. If immediate patching is not possible, reduce exposure by limiting interactive logon rights, removing unnecessary local users, enforcing least privilege, controlling execution from user-writable directories, enabling application control, and increasing monitoring for local privilege escalation behavior.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative update or security-only update that includes the fix for CVE-2026-45638. Validate through enterprise patch reporting, Windows Update history, Get-HotFix, DISM package inventory, vulnerability scanner plugins, or Microsoft Defender Vulnerability Management where available. Confirm that afd.sys has been updated to the expected post-patch version for the operating system build, using trusted Microsoft release metadata as the source of truth. Re-scan representative Windows 10, Windows 11, and Windows Server assets after patch deployment to verify the vulnerability is no longer reported. Where patch compliance is uncertain, compare OS build and update level against Microsoft’s security update guidance for the June 2026 release train or the relevant cumulative update branch.

Typical attack path

1. Obtain initial access to an affected Windows workstation or server as a low-privileged authenticated user or by executing code through another foothold.
2. Run a local exploit program that interacts with WinSock/AFD kernel interfaces.
3. Trigger the use-after-free condition in the Windows Ancillary Function Driver for WinSock.
4. Manipulate freed kernel memory so that the driver dereferences attacker-influenced data.
5. Gain elevated execution in kernel context or as NT AUTHORITY\SYSTEM.
6. Use the elevated privileges to disable defenses, access protected files, dump credentials, create persistence, or move laterally.

How to detect it

There are no public exploit-specific indicators provided for this vulnerability, and local kernel privilege-escalation attempts often leave limited direct evidence. Detection should therefore focus on behavioral chains before and after elevation. Review EDR telemetry, Sysmon, Windows Security logs, PowerShell logs, Defender logs, and service-control events for a low-privileged process that quickly gains SYSTEM privileges, spawns elevated command shells, creates services, creates scheduled tasks, modifies security tooling, or accesses credential stores. Useful Windows events include process creation telemetry, Security 4688, service installation 7045, scheduled task creation events, logon events 4624/4672, privilege use events where collected, Defender tamper/protection events, and Sysmon events for process creation, driver load, file creation, and registry modification. Investigate suspicious binaries executed from user-writable paths such as Downloads, Temp, AppData, public shares, or removable media followed by SYSTEM-level activity. Compare afd.sys timestamps and versions against known-good patched baselines, but do not treat the driver path itself as malicious. If exploitation is suspected, preserve memory where possible because kernel exploitation artifacts may not persist on disk, collect EDR process lineage, review crash dumps or bugchecks around the time of suspicious activity, and hunt for post-exploitation actions such as LSASS access, credential dumping tools, new local administrators, disabled endpoint protection, new persistence mechanisms, and lateral movement attempts.

What your security team should do

• Deploy the applicable Microsoft security update across affected Windows clients and servers, prioritizing high-value servers and systems used by privileged users.
• Inventory all affected Windows versions, including older Windows 10 and Windows Server releases, and verify they are still receiving security updates under a supported servicing channel.
• Treat this as a privilege-escalation risk: hunt for signs of low-privileged processes unexpectedly spawning SYSTEM-level shells, services, scheduled tasks, or security-tool tampering.
• Restrict local administrator membership and interactive logon rights to reduce the value of successful exploitation.
• Enable or enforce endpoint controls such as Microsoft Defender, attack surface reduction rules, application control, credential protection, and tamper protection.
• Monitor for suspicious post-exploitation activity, including credential dumping, new services, new scheduled tasks, LSASS access, driver loading, and endpoint protection disablement.
• For servers that cannot be patched quickly, isolate management access, limit local code execution paths, and increase EDR logging until remediation is complete.
• Track Microsoft advisories for any later exploit publication, revised affected-version data, fixed build details, or change in exploitation status.