CVE-2026-21236: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-21236 Overview

CVE-2026-21236 is a heap-based buffer overflow vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys). This kernel-mode driver provides essential networking functionality for Windows systems. An authorized local attacker can exploit this vulnerability to elevate privileges from a standard user to SYSTEM-level access, potentially gaining complete control over the affected system.

Critical Impact

Local privilege escalation via heap-based buffer overflow in AFD.sys kernel driver, enabling authorized attackers to gain SYSTEM privileges across a wide range of Windows client and server operating systems.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) - x86, x64, and ARM64 architectures
• Microsoft Windows 11 (versions 23H2, 24H2, 25H2) - x64 and ARM64 architectures
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-02-10 - CVE-2026-21236 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21236

Vulnerability Analysis

This vulnerability resides in the Windows Ancillary Function Driver for WinSock (AFD.sys), a critical kernel-mode component that provides socket transport functionality for Windows networking. The driver processes I/O requests from user-mode applications and interfaces with lower-level network drivers in the Windows networking stack.

The heap-based buffer overflow (CWE-122, CWE-787) occurs when the AFD driver improperly validates the size of data being written to a heap-allocated buffer. When a local attacker supplies specially crafted input, the driver writes data beyond the allocated buffer boundaries, corrupting adjacent heap memory structures.

Because AFD.sys operates in kernel mode with SYSTEM privileges, successful exploitation allows an attacker to execute arbitrary code with the highest privilege level on the system. This can lead to complete system compromise, including the ability to install malware, access sensitive data, create new privileged accounts, or disable security controls.

Root Cause

The vulnerability stems from improper bounds checking in the AFD driver when handling network socket operations. The driver fails to properly validate buffer length parameters before performing memory copy operations, resulting in an out-of-bounds write condition in kernel heap memory. This is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).

Attack Vector

The attack requires local access to the target system with valid user credentials. An attacker must execute a malicious application or script that sends specially crafted IOCTL (I/O Control) requests to the AFD driver through the Windows socket API. The crafted request contains malformed size parameters that cause the driver to overflow a heap buffer, potentially overwriting critical kernel data structures.

By carefully controlling the overflow data, an attacker can corrupt heap metadata or adjacent objects to achieve arbitrary code execution in kernel context. This technique is commonly used to elevate privileges from a standard user account to SYSTEM, bypassing all operating system security controls.

Detection Methods for CVE-2026-21236

Indicators of Compromise

• Unexpected system crashes or blue screens (BSOD) with AFD.sys in the crash dump
• Unusual process creation events where low-privileged processes spawn SYSTEM-level child processes
• Suspicious IOCTL requests to the AFD driver from non-standard applications
• Windows Event Log entries indicating privilege escalation attempts or token manipulation

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious kernel-mode activity and privilege escalation patterns
• Enable Windows Defender Exploit Guard and Attack Surface Reduction rules to detect heap spray and buffer overflow exploitation techniques
• Monitor for unusual socket operations and IOCTL requests to \\Device\\Afd from unexpected processes
• Implement behavioral analysis to detect processes attempting to elevate privileges through kernel driver exploitation

Monitoring Recommendations

• Configure enhanced audit policies to log process creation, token manipulation, and privilege use events
• Monitor system integrity using Windows Security Center and SentinelOne's kernel-level protection capabilities
• Review crash dumps and memory forensics for signs of heap corruption exploitation
• Establish baseline network driver behavior and alert on anomalous AFD driver interactions

How to Mitigate CVE-2026-21236

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-21236 immediately on all affected Windows systems
• Prioritize patching on systems with local user access, especially workstations and terminal servers
• Review and restrict local user access rights where possible to limit potential attack surface
• Enable SentinelOne's real-time protection to detect and block privilege escalation attempts

Patch Information

Microsoft has released security updates to address this vulnerability. Detailed patch information and download links are available in the Microsoft Security Update Guide for CVE-2026-21236. Organizations should apply the relevant cumulative update for their specific Windows version through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

• Restrict local logon rights to limit the pool of users who could potentially exploit this vulnerability
• Implement application control policies to prevent unauthorized executables from running
• Use Windows Defender Credential Guard to protect against credential theft following privilege escalation
• Consider network segmentation to limit lateral movement if a system is compromised

# Verify AFD.sys driver version after patching
# Run from elevated PowerShell prompt
Get-Item C:\Windows\System32\drivers\afd.sys | Select-Object Name, VersionInfo

# Check Windows Update installation status
Get-HotFix | Where-Object {$_.InstalledOn -gt (Get-Date).AddDays(-30)} | Sort-Object InstalledOn -Descending