CVSS : 7.8

Target Service

Windows Ancillary Function Driver for WinSock (AFD.sys)

  • Driver that operates in Windows kernel mode
  • Networking component that handles user mode WinSock(Windows Socket) API calls at the kernel level
  • Implements socket services for network protocols such as TCP/IP, UDP, etc.
  • Marshals user-mode socket APIs, handles IOCTL and control requests, and interacts with low-level transport drivers
  • Runs in a kernel context yet can be accessed through common networking APIs

Affected Versions

  • Windows 11: 22H3, 23H2, 24H2, 25H2, 26H1 (build 10.0.28000.0)
  • Windows 10: 1607, 1809, 21H2, 22H2
  • Windows Server: 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025

Vulnerability Overview

Vulnerability Types

  • Local elevation of privilege (LPE)
  • Heap-based Buffer Overflow

This is a privilege escalation vulnerability that allows local users authorized through heap-based BOF to acquire SYSTEM level privileges.

Root Cause

  • The cause is that the size verification of the heap memory buffer within the AFD.sys driver was inadequate.
  • The WinSock driver does not properly verify the boundaries of the buffer allocated on the heap when processing data received in user mode.
  • AFD.sys processes WinSock API at the kernel boundary and exposes IOCTL, socket options, and management tasks to user mode. In this process, the privileged code path is exposed to user input, so verification of buffer size, ownership, and synchronization is important.
  • In this vulnerability, this verification was insufficient and a heap overflow could occur.

Exploitation Mechanism

Attack Flow

  • An attacker accesses the system with a low-privileged local user account (via malware, etc.)
  • The attacker calls the WinSock API in user mode and sends a manipulated IOCTL request to the AFD.sys driver.
  • When the manipulated input is passed to AFD.sys in kernel mode, the driver overwrites the adjacent memory area by exceeding the range of the allocated buffer due to lack of boundary verification in the process of writing data to the buffer allocated to the heap.
  • Due to the overflow, the core data structure of the kernel memory is damaged, and the attacker gains SYSTEM level privileges by manipulating tokens and creating the SYSTEM process.

Patch Details

February 11, 2026 Patch

A total of 58 vulnerabilities were fixed and these vulnerabilities were also included in this release.

AFD.sys driver files are replaced with patched versions and validation is added to memory operations to prevent privilege escalation.