CVE-2026-45596 Overview
CVE-2026-45596 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). An authenticated local attacker can exploit a race condition in the driver to access freed kernel memory and elevate privileges to SYSTEM. The flaw is classified under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization). Microsoft has acknowledged the issue through the Microsoft Security Response Center advisory.
Critical Impact
Successful exploitation grants kernel-mode privileges, allowing attackers to bypass security boundaries, disable endpoint protections, and establish persistence across reboots on affected Windows desktop and server systems.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-06-09 - CVE-2026-45596 published to NVD
- 2026-06-11 - Last updated in NVD database
Technical Details for CVE-2026-45596
Vulnerability Analysis
The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode component that implements the Windows Sockets interface for user-mode applications. The driver handles socket operations including I/O Request Packets (IRPs), asynchronous completion routines, and shared kernel objects accessed across multiple threads.
The vulnerability stems from improper synchronization when an object is freed by one thread while another thread retains and dereferences a stale pointer. An attacker who wins this race can reclaim the freed allocation with controlled data, then trigger the dangling reference to corrupt kernel memory. This results in confidentiality, integrity, and availability impact at the kernel level.
Root Cause
The root cause is a [CWE-362] race condition in afd.sys that leads to a use-after-free condition. The driver releases a kernel object without ensuring all concurrent references have been retired. Because attack complexity is rated High, exploitation depends on precise timing to align the free operation with a subsequent dereference.
Attack Vector
Exploitation requires local access and low-privileged authenticated execution on the target host. No user interaction is needed. An attacker typically spawns racing threads that repeatedly issue WinSock IOCTLs to afd.sys, attempting to free a target object while a sibling thread holds a pointer to it. Successful exploitation pivots a low-privileged process to SYSTEM, enabling full host compromise.
No public proof-of-concept code is currently available for CVE-2026-45596, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-45596
Indicators of Compromise
- Unexpected SYSTEM-level child processes spawned from standard user contexts immediately after WinSock-intensive activity.
- Kernel bug checks referencing afd.sys (for example, BAD_POOL_CALLER or DRIVER_VERIFIER_DETECTED_VIOLATION) on unpatched systems.
- Anomalous token duplication or impersonation events originating from non-administrative processes.
Detection Strategies
- Monitor for processes that abruptly transition from a medium or low integrity level to SYSTEM without a corresponding legitimate elevation path.
- Alert on user-mode processes issuing high-frequency DeviceIoControl calls to \\Device\\Afd with multi-threaded patterns characteristic of race-condition exploitation.
- Correlate Sysmon Event ID 1 (process creation) with Event ID 10 (process access) to identify privilege escalation chains following WinSock activity.
Monitoring Recommendations
- Enable Windows kernel-mode driver telemetry and ingest Microsoft Defender or third-party EDR logs into a centralized data lake for retrospective hunting.
- Track patch deployment status for the June 2026 Microsoft cumulative updates across all Windows endpoints and servers.
- Review crash dumps referencing afd.sys and submit suspicious dumps for triage to identify potential exploitation attempts.
How to Mitigate CVE-2026-45596
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-45596 advisory to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching on multi-tenant hosts, terminal servers, and shared workstations where low-privileged users execute code.
- Audit local user accounts and remove unnecessary interactive logon rights to reduce the attacker pool.
Patch Information
Microsoft has released cumulative security updates addressing CVE-2026-45596. Refer to the Microsoft CVE-2026-45596 Update for the specific KB articles applicable to each Windows version and architecture. Install the update via Windows Update, WSUS, or Microsoft Update Catalog, then reboot to load the patched afd.sys driver.
Workarounds
- No vendor-supplied workaround replaces the patch. Apply the security update as the primary remediation.
- Enforce least-privilege policies and application allow-listing to reduce the likelihood that an unprivileged attacker can stage exploitation tooling.
- Enable Windows Defender Exploit Guard and Hypervisor-Protected Code Integrity (HVCI) to raise the bar for kernel exploitation on supported hardware.
# Verify afd.sys version after patch installation (PowerShell)
Get-Item C:\Windows\System32\drivers\afd.sys | Select-Object Name, VersionInfo
# Confirm the latest cumulative update is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
