CVE-2026-26173: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-26173 Overview

CVE-2026-26173 is a race condition vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw arises from concurrent execution using a shared resource with improper synchronization [CWE-362]. An authenticated local attacker can exploit the race window to elevate privileges on a vulnerable Windows host.

Microsoft published the advisory on April 14, 2026, covering supported Windows client and server releases. Successful exploitation results in high impact to confidentiality, integrity, and availability.

Critical Impact

A local, authorized attacker who wins the race condition in afd.sys can elevate to SYSTEM, gaining full control of the affected Windows host.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-26173 published to NVD with Microsoft advisory
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-26173

Vulnerability Analysis

The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode driver that backs the Windows Sockets API. It mediates socket operations between user-mode applications and the TCP/IP stack. Because it serves concurrent I/O requests from multiple threads, internal state objects must be guarded by proper synchronization primitives.

In CVE-2026-26173, a shared resource inside afd.sys can be accessed by two threads without adequate locking. An attacker who issues carefully timed socket operations can interleave operations so that one thread observes or modifies state that another thread is concurrently transitioning. The result is a corrupted kernel object state that an attacker can leverage to execute code in kernel context.

Root Cause

The root cause is an improper synchronization defect classified under [CWE-362]. A code path in afd.sys performs validation and use of a shared kernel object across separate operations without holding a lock for the full duration. This creates a time-of-check to time-of-use window where the object can be freed, reallocated, or transitioned by a competing thread.

Attack Vector

Exploitation requires local access and low-privileged authenticated credentials. The attack complexity is high because the attacker must reliably win a narrow race window, typically by racing IOCTL or socket handle operations across multiple threads. No user interaction is needed. Once the race is won, the attacker corrupts kernel state to redirect execution or escalate the process token to SYSTEM.

No public proof-of-concept is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. See the Microsoft Security Update Guide CVE-2026-26173 for vendor technical details.

Detection Methods for CVE-2026-26173

Indicators of Compromise

• Unexpected SYSTEM-level processes spawned from a standard user session shortly after high-volume socket handle activity
• Kernel bugchecks referencing afd.sys on otherwise stable hosts, which may indicate failed exploit attempts
• Creation or loading of unsigned drivers or kernel modules immediately after suspicious socket activity

Detection Strategies

• Hunt for processes opening large numbers of \Device\Afd handles and issuing rapid IOCTLs from non-privileged accounts
• Correlate token elevation events (Event ID 4672, 4673) with parent processes that should not be SYSTEM
• Monitor for known local privilege escalation tool signatures and behaviors that target afd.sys

Monitoring Recommendations

• Enable kernel-mode auditing and forward Windows Security and Sysmon logs to a centralized analytics platform
• Track patch compliance for the April 2026 Windows cumulative updates across all endpoints and servers
• Alert on local accounts running tools that interact directly with low-level WinSock interfaces outside known administrative workflows

How to Mitigate CVE-2026-26173

Immediate Actions Required

• Apply the April 2026 Microsoft security updates referenced in the Microsoft Security Update Guide CVE-2026-26173 to all affected Windows clients and servers
• Prioritize multi-user systems, terminal servers, and developer workstations where local users are most likely to attempt privilege escalation
• Restrict interactive and remote desktop access to trusted administrative users while patches are being deployed

Patch Information

Microsoft addressed CVE-2026-26173 through the April 2026 cumulative updates for Windows 10, Windows 11, and Windows Server. Refer to the vendor advisory for the specific KB numbers that apply to each build. Systems running Windows Server 2012 require the Extended Security Updates channel.

Workarounds

• No official vendor workaround is documented; applying the security update is the recommended remediation
• Reduce local user privileges and enforce application allow-listing to limit which binaries can interact with afd.sys
• Enable Windows Defender Application Control or equivalent kernel driver block policies to prevent loading of unauthorized helper drivers used in chained exploits

# Verify the AFD driver version after patching (run in elevated PowerShell)
Get-Item C:\Windows\System32\drivers\afd.sys | Select-Object VersionInfo

# List installed updates to confirm the April 2026 cumulative update is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10