CVE-2025-49661 Overview
CVE-2025-49661 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw is an untrusted pointer dereference [CWE-822] that a locally authenticated attacker can exploit to gain SYSTEM-level privileges. Microsoft published the advisory on July 8, 2025, covering both client and server editions of Windows from Windows Server 2008 through Windows 11 24H2 and Windows Server 2025. Because afd.sys is a kernel-mode driver reachable from low-privileged user contexts, successful exploitation grants full control over confidentiality, integrity, and availability on the target host.
Critical Impact
A local, authenticated attacker can dereference an untrusted kernel pointer in afd.sys and elevate to SYSTEM, enabling complete host compromise.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) x86 and x64
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008 SP2, Server 2008 R2 SP1, Server 2012 / 2012 R2, Server 2016, 2019, 2022, 2022 23H2, and Server 2025
Discovery Timeline
- 2025-07-08 - CVE-2025-49661 published to NVD and Microsoft security advisory released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49661
Vulnerability Analysis
The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode component that services user-mode WinSock (ws2_32.dll) requests through NtDeviceIoControlFile and related IOCTLs. CVE-2025-49661 is classified as an untrusted pointer dereference, meaning the driver treats attacker-influenced data as a valid kernel pointer without adequate validation. When the driver dereferences that pointer, it reads from or writes to memory the attacker can influence, leading to controlled kernel memory corruption.
Successful exploitation typically pivots into a write-what-where primitive against kernel structures such as _EPROCESS.Token, allowing the attacker to substitute a SYSTEM token into a low-privileged process. The attack is executed locally by an authenticated user without any user interaction, matching common local privilege escalation (LPE) tradecraft seen in post-exploitation of phishing footholds or malicious insider activity.
Root Cause
The root cause is improper validation of a pointer value that originates from an untrusted source, categorized under [CWE-822: Untrusted Pointer Dereference]. Within afd.sys, an IOCTL handler consumes a caller-supplied structure and treats a field within it as a kernel-usable pointer before performing sufficient probing or type verification.
Attack Vector
The attack vector is local. An attacker who already holds low-privileged execution on the target host, for example through a malicious document, browser exploit, or stolen credentials, invokes crafted IOCTLs against the \Device\Afd handle. No user interaction is required, and no additional privileges beyond a standard interactive logon are needed to trigger the kernel dereference.
No verified public proof-of-concept code is available. See the Microsoft CVE-2025-49661 Advisory for authoritative technical details.
Detection Methods for CVE-2025-49661
Indicators of Compromise
- Unexpected loading of handles to \Device\Afd by non-networking processes, especially short-lived or user-writable binaries.
- New SYSTEM-context child processes spawned from a medium-integrity parent shortly after WinSock IOCTL activity.
- Kernel bugchecks referencing afd.sys in KERNEL_MODE_EXCEPTION_NOT_HANDLED or SYSTEM_SERVICE_EXCEPTION crash dumps.
Detection Strategies
- Hunt for token-swap behavior: processes whose primary token integrity or SID changes to SYSTEM without a legitimate service invocation.
- Correlate suspicious NtDeviceIoControlFile telemetry against afd.sys with the invoking image path and command line.
- Alert on driver crashes and Event ID 1001 (BugCheck) mentioning afd.sys across the fleet, which can signal failed exploitation attempts.
Monitoring Recommendations
- Enable kernel process and token creation auditing (Event IDs 4688 and 4696) with command-line logging.
- Ingest Windows Error Reporting and mini-dump metadata into a central data lake to identify recurring afd.sys faults.
- Baseline expected consumers of WinSock IOCTLs so anomalous callers surface quickly during triage.
How to Mitigate CVE-2025-49661
Immediate Actions Required
- Apply the July 2025 Microsoft security updates that address CVE-2025-49661 across all affected Windows client and server SKUs.
- Prioritize patching multi-user hosts, jump servers, RDS/Citrix session hosts, and domain-joined workstations where LPE has the highest blast radius.
- Rotate credentials and review privileged group membership on any host where suspicious afd.sys activity was observed prior to patching.
Patch Information
Microsoft released fixes as part of the July 2025 Patch Tuesday cycle. Refer to the Microsoft CVE-2025-49661 Advisory for the specific KB articles that map to each supported Windows build. Install updates through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch orchestration tooling.
Workarounds
- No official workaround exists; applying the vendor patch is the only supported remediation.
- Reduce local attack surface by removing administrative rights from standard users and enforcing application allowlisting to limit unauthorized binary execution.
- Enable Hypervisor-Protected Code Integrity (HVCI) and Credential Guard where supported to raise the cost of kernel exploitation and token theft.
# Verify patch state on Windows hosts using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Query WinSock driver version to confirm update deployment
Get-Item C:\Windows\System32\drivers\afd.sys | Select-Object VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
