CVE-2026-25179: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-25179 Overview

CVE-2026-25179 is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw stems from improper validation of a specified type of input [CWE-1287], allowing an authenticated local attacker to elevate privileges on the affected host. Microsoft published the advisory on 2026-03-10, and the issue affects a broad range of supported Windows client and server releases. Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability of the operating system.

Critical Impact
An authorized local user can escalate to SYSTEM-level privileges by abusing improper input type validation in the WinSock kernel driver, enabling full host compromise from a low-privileged account.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-03-10 - Microsoft releases security advisory for CVE-2026-25179
2026-03-10 - CVE-2026-25179 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-25179

Vulnerability Analysis

The Ancillary Function Driver for WinSock (afd.sys) is a kernel-mode driver that brokers WinSock socket operations between user-mode applications and the Windows network stack. CVE-2026-25179 is a privilege escalation issue caused by improper validation of the specified type of input passed into the driver. When an attacker submits a crafted request to an afd.sys interface, the driver does not correctly verify that the input matches the expected type or structure before processing it.

The weakness maps to CWE-1287, Improper Validation of Specified Type of Input. Exploitation requires local access and low privileges, and the attack complexity is high, which suggests the issue depends on winning a specific condition or constructing a precise input layout. The vulnerability does not require user interaction. EPSS modeling currently rates exploitation probability as low, but the broad install base raises the practical exposure across enterprise fleets.

Root Cause

The root cause is missing or incorrect type validation inside an afd.sys request handler. The driver trusts a caller-supplied descriptor or buffer field without confirming it represents the type the handler expects. Acting on the mismatched data leads to incorrect memory interpretation in kernel context, which an attacker can leverage to manipulate kernel state.

Attack Vector

An attacker must first execute code on the target as a standard authenticated user. The attacker then opens a handle to the affected WinSock device and issues DeviceIoControl calls with crafted input structures that bypass the driver's type checks. By chaining the resulting kernel memory corruption or state confusion with a token-replacement primitive, the attacker promotes their process token to SYSTEM. This pattern is consistent with prior afd.sys elevation-of-privilege chains used in commodity malware and post-exploitation toolkits.

// No verified public proof-of-concept is available for CVE-2026-25179.
// Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2026-25179

Indicators of Compromise

Unexpected processes opening handles to \Device\Afd followed by elevation of the parent token to SYSTEM
Standard user processes spawning child processes running as NT AUTHORITY\SYSTEM without a legitimate service parent
Crashes or bug checks referencing afd.sys on hosts that previously had no driver instability

Detection Strategies

Hunt for low-integrity processes issuing NtDeviceIoControlFile calls against the AFD device followed by token manipulation APIs such as NtSetInformationToken or duplication of the lsass.exe token.
Correlate process creation events (Sysmon Event ID 1, Windows Security 4688) where the parent runs as a standard user but the child runs as SYSTEM.
Monitor for kernel exploitation telemetry, including unexpected reads of EPROCESS structures or modifications to process tokens from user-mode initiated I/O.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block credential theft and process token abuse.
Forward kernel crash dumps and WER reports referencing afd.sys to a central analytics pipeline for review.
Track patch state for the March 2026 Windows security updates across all endpoints and servers using configuration management tooling.

How to Mitigate CVE-2026-25179

Immediate Actions Required

Apply the March 2026 Microsoft security update that addresses CVE-2026-25179 to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching multi-user systems, terminal servers, jump hosts, and developer workstations where local code execution by non-administrators is expected.
Restrict the ability of standard users to run unsigned or untrusted binaries using Windows Defender Application Control or AppLocker.

Patch Information

Microsoft has released cumulative updates that remediate this vulnerability. Refer to the Microsoft CVE-2026-25179 Advisory for the exact KB numbers per affected build. Install the corresponding monthly rollup or security-only update for each Windows version present in the environment.

Workarounds

No official workaround replaces the security update; Microsoft recommends installing the patch.
Reduce risk by enforcing least privilege so that fewer accounts can authenticate interactively to affected hosts.
Limit local logon rights on servers and isolate untrusted workloads to dedicated, segmented systems until patching is complete.

bash

# Verify the installed update on a Windows host
wmic qfe list brief /format:table

# Or via PowerShell, list recent hotfixes
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10