CVE-2026-35416 Overview
CVE-2026-35416 is a use-after-free vulnerability [CWE-416] in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw allows an authenticated local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on May 12, 2026, covering Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Successful exploitation can yield SYSTEM-level code execution from a low-privileged user context.
Critical Impact
An authorized local attacker can exploit a use-after-free condition in afd.sys to escalate privileges and gain full control over the host, including kernel-mode code execution.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
- Affected component: Windows Ancillary Function Driver for WinSock (afd.sys)
Discovery Timeline
- 2026-05-12 - CVE-2026-35416 published to NVD
- 2026-05-12 - Microsoft releases security advisory and patches
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-35416
Vulnerability Analysis
The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode driver that backs the user-mode Winsock API. It handles socket I/O, IOCTLs, and asynchronous completion routines for nearly all TCP/IP-based applications on Windows. Because afd.sys is reachable from every user session, defects in its object lifetime management have historically been used as reliable local privilege escalation primitives.
CVE-2026-35416 is a use-after-free defect [CWE-416] within this driver. The attack requires local access and valid authentication, but no user interaction. The CVSS vector indicates high attack complexity, suggesting the attacker must win a timing or state-dependent condition to trigger the dangling pointer reuse.
Root Cause
The root cause is improper object lifetime management inside afd.sys. A kernel object is freed while another code path retains a reference to it. When the attacker controls subsequent allocations, they can reclaim the freed slab with attacker-shaped data and force the driver to operate on the stale pointer.
Attack Vector
Exploitation requires a local, authenticated attacker. The attacker invokes Winsock IOCTLs from a low-privileged process to drive afd.sys into the vulnerable state, then races to reclaim the freed allocation before the driver dereferences it. Reliable exploitation typically chains the UAF with a kernel address leak to construct an arbitrary read/write primitive and overwrite the current process token to obtain SYSTEM privileges.
No verified public proof-of-concept code was available at the time of publication. See the Microsoft Security Advisory for vendor technical details.
Detection Methods for CVE-2026-35416
Indicators of Compromise
- Unexpected child processes (for example, cmd.exe, powershell.exe) spawned as NT AUTHORITY\SYSTEM from a parent running as a standard user.
- Process token replacement events where a non-elevated process suddenly executes with SYSTEM or elevated integrity.
- Bug checks or afd.sys kernel exceptions on systems where this driver is rarely faulting.
Detection Strategies
- Hunt for local privilege escalation chains: a medium-integrity process opening high-privilege handles or modifying privileged registry keys shortly after issuing Winsock IOCTLs.
- Correlate abnormal NtDeviceIoControlFile activity against \Device\Afd with subsequent token manipulation or LSASS access.
- Baseline expected callers of afd.sys IOCTLs and alert on unsigned or newly observed binaries issuing high volumes of socket control requests.
Monitoring Recommendations
- Enable Windows kernel auditing and forward Sysmon Event IDs 1 (process create) and 10 (process access) to a centralized analytics platform.
- Monitor for crash dumps referencing afd! symbols, which can indicate failed exploitation attempts.
- Track patch deployment state for the May 2026 Windows updates across all endpoints and servers to identify exposed hosts.
How to Mitigate CVE-2026-35416
Immediate Actions Required
- Apply the May 2026 Microsoft security updates to all affected Windows client and server SKUs.
- Prioritize patching multi-user systems, jump hosts, RDS servers, and developer workstations where untrusted local code can run.
- Restrict the ability for standard users to execute arbitrary binaries through application control policies such as Windows Defender Application Control or AppLocker.
Patch Information
Microsoft has released cumulative security updates that remediate CVE-2026-35416 in afd.sys. Refer to the Microsoft Security Advisory for the build numbers and KB articles corresponding to each affected Windows version.
Workarounds
- No vendor-supplied workaround exists; patch installation is the supported remediation path.
- Reduce exposure by enforcing least-privilege accounts and removing local administrator rights from end-user workstations.
- Limit interactive logon to servers via Group Policy, reducing the population of users who can reach the local attack surface.
# Verify the installed Windows build and patch level on affected hosts
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
[System.Environment]::OSVersion.Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
