CVE-2026-34335: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-34335 Overview

CVE-2026-34335 is a use-after-free vulnerability [CWE-416] in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw enables an authenticated local attacker to elevate privileges on affected Windows desktop and server platforms. Successful exploitation grants the attacker SYSTEM-level access, breaking the boundary between low-privileged user code and the Windows kernel.

Microsoft published the advisory on June 9, 2026, and the issue affects a broad range of supported Windows 10, Windows 11, and Windows Server releases. The vulnerability requires local access and valid credentials, and the attack complexity is high.

Critical Impact
An authorized local attacker can exploit a kernel-mode use-after-free in afd.sys to gain SYSTEM privileges, leading to full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-06-09 - CVE-2026-34335 published to NVD with Microsoft advisory release
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-34335

Vulnerability Analysis

The Ancillary Function Driver for WinSock, implemented in afd.sys, is the kernel-mode component that backs the user-mode Winsock API. It handles socket creation, I/O control requests, and asynchronous network operations on behalf of every process that uses TCP/IP sockets on Windows.

CVE-2026-34335 is a use-after-free condition in this driver. The driver retains or dereferences a pointer to a kernel object after that object has been freed. An attacker who controls allocation patterns can reclaim the freed memory with attacker-shaped data before the stale pointer is reused, allowing manipulation of kernel structures.

Local authenticated access is required, and exploitation depends on winning a timing window. When the conditions are met, the attacker can corrupt kernel memory to redirect execution or modify privilege tokens, resulting in elevation from a standard user context to SYSTEM.

Root Cause

The root cause is improper object lifetime management inside afd.sys. A reference to a Winsock-related kernel object is not invalidated or reference-counted correctly across concurrent IOCTL paths. When the object is released on one path while another path still operates on the same pointer, the driver dereferences freed pool memory.

Attack Vector

Exploitation is local and requires the attacker to execute code as a low-privileged user. The attacker issues a crafted sequence of socket and I/O control calls to afd.sys that triggers the freeing of an internal object while a second operation continues to reference it. By spraying the kernel pool to reoccupy the freed allocation, the attacker corrupts kernel state and pivots to SYSTEM, typically by overwriting a process token or hijacking a kernel callback.

No public proof-of-concept code is currently associated with this CVE, and Microsoft has not reported in-the-wild exploitation. See the Microsoft Security Update Guide entry for CVE-2026-34335 for vendor details.

Detection Methods for CVE-2026-34335

Indicators of Compromise

Unexpected SYSTEM-level child processes spawned from interactive or service accounts that normally run as standard users.
Kernel bug checks referencing afd.sys, particularly BAD_POOL_HEADER, KERNEL_MODE_HEAP_CORRUPTION, or DRIVER_VERIFIER_DETECTED_VIOLATION on hosts under attack.
Process token modifications where a non-elevated process suddenly gains SYSTEM or high-integrity context without a documented UAC elevation.

Detection Strategies

Hunt for local processes that open handles to \Device\Afd and immediately issue uncommon DeviceIoControl patterns followed by privilege changes.
Correlate Windows Event ID 4672 (special privileges assigned) with the originating parent process to surface unexpected privilege grants tied to non-admin users.
Monitor for kernel pool spraying behavior: rapid creation and teardown of sockets combined with large, repeated allocations from a single low-privileged process.

Monitoring Recommendations

Enable Windows kernel-mode crash dump collection and forward Minidump artifacts to a central data lake for analysis of afd.sys-related faults.
Alert on local privilege escalation chains using behavioral detections that link a user-context process to a subsequent SYSTEM-context action without a known elevation API call.
Audit non-standard executables that interact heavily with Winsock kernel objects on servers that do not typically host network applications.

How to Mitigate CVE-2026-34335

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-34335 to every affected Windows 10, Windows 11, and Windows Server build.
Prioritize patching multi-user systems, terminal servers, and developer workstations where untrusted code is most likely to execute.
Restrict interactive logon and local code execution rights on servers to limit the population of accounts that can reach afd.sys from user mode.

Patch Information

Microsoft has released cumulative security updates that remediate the use-after-free in afd.sys. Refer to the Microsoft CVE-2026-34335 Update for the specific KB articles and build numbers that correspond to each affected Windows version. Install the updates through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management workflow.

Workarounds

No vendor-supplied workaround replaces the patch; install the security update as soon as testing permits.
Enforce least privilege so that standard users cannot run arbitrary native binaries, reducing the local code execution surface required for exploitation.
Enable Windows Defender Exploit Guard, Hypervisor-protected Code Integrity (HVCI), and Kernel Driver Block Rules to raise the cost of kernel exploitation on unpatched hosts.

bash

# Verify the installed Windows build and confirm the security update is applied
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe list brief /format:table

# Example: install an offline MSU package distributed via your patch tooling
wusa.exe C:\Updates\windows10.0-kb-cve-2026-34335-x64.msu /quiet /norestart