CVE-2026-45638: Windows Ancillary Function Driver Privilege Escalation Vulnerability

Technical summary

CVE-2026-45638 is a heap-based buffer overflow (CWE-122) in the Windows Ancillary Function Driver for WinSock (afd.sys). The vulnerability allows an authenticated local attacker to write beyond allocated heap memory boundaries, corrupting adjacent data structures. By crafting malicious input to WinSock API calls, an attacker can overwrite critical kernel objects and achieve privilege escalation from a low-privilege user context to SYSTEM. The flaw affects multiple Windows 10 and Windows 11 releases, as well as Windows Server 2012 through 2025. No user interaction is required for exploitation.

Business impact

Organizations face an elevated risk of privilege escalation attacks in environments where insider threats or prior compromises exist. Once an attacker gains any user-level access—through phishing, malware, or a secondary vulnerability—they can weaponize this flaw to obtain full system control, leading to potential data exfiltration, lateral movement, and infrastructure compromise. The wide scope of affected Windows versions means patching demand will be significant across enterprise estates. Unpatched systems become stepping stones for multi-stage attacks.

Affected systems

All consumer and server Windows releases spanning Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H1) are affected. Enterprise deployments of Windows Server 2012, 2016, 2019, 2022, and 2025 are also in scope. Organizations with extended lifecycle support contracts for older Windows 10 versions (1607, 1809) and Server 2012 should note potential patch availability constraints; verify support status with Microsoft.

Exploitability

Exploitation requires local code execution with authenticated user privileges. The flaw cannot be triggered remotely over the network. However, the barrier to exploitation is low once an attacker is local—no special Windows Sandbox escape, no race condition timing, and no user interaction needed. Proof-of-concept development is straightforward for skilled adversaries. The attack vector remains bounded by the need for initial access, which prevents widespread remote worm-like propagation but makes this a critical link in multi-stage compromise chains.

Remediation

Microsoft security patches addressing this buffer overflow are the definitive remediation. Organizations should prioritize patching all affected Windows 10 and Windows 11 endpoints, as well as Windows Server infrastructure. For systems with extended support lifecycles, confirm patch availability before scheduling maintenance windows. Mitigating controls such as enforcing least-privilege accounts, disabling unnecessary network services, and monitoring for unusual privilege escalation activity can reduce exploitation risk on machines awaiting patches, but do not eliminate the vulnerability.

Patch guidance

Apply Microsoft's security update for CVE-2026-45638 as soon as feasible within your change management process. Microsoft typically bundles fixes into monthly Patch Tuesday releases; verify the specific KB article and update number through the Microsoft Security Update Guide. Test patches in a non-production environment first, particularly in server deployments where WinSock functionality may be heavily used. Organizations running Windows 10 versions 1607 and 1809 should confirm these versions remain in support or plan migration timelines alongside patching efforts.

Detection guidance

Monitor endpoint and host-based detection systems for anomalous heap corruption patterns, kernel debugger activity, or privilege escalation audit events. Look for processes attempting to interact with afd.sys through unusual WinSock API sequences or IOCTL calls. Windows Defender and third-party EDR solutions can flag suspicious kernel-mode activity and token impersonation attempts. Configure audit policies to log failed and successful privilege escalations. Behavioral baselines for your environment are essential—privilege escalation attempts are relatively rare in normal operations and should trigger investigation.

Why prioritize this

With a CVSS score of 7.8 (HIGH) and a straightforward local privilege escalation path, this vulnerability sits in the upper tier of operational risk. Absence from the CISA KEV catalog does not diminish its severity; it indicates no confirmed active exploitation at publication, but the technical simplicity and broad affected base make it an attractive target for sophisticated adversaries and insider threats. Any organization with multi-user systems or shared infrastructure should treat this as a high-priority patch cycle item, especially where users have network access, removable media, or supply chain touchpoints.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects the combination of local attack surface (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and unchanged scope (S:U), balanced against high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of unrestricted system compromise achievable from an authenticated low-privilege account. Contextually, the lack of network exploitability and requirement for prior access prevent a critical score, but the completeness of post-compromise control justifies the HIGH severity classification.

Frequently asked questions