CVE-2026-45598 Overview
CVE-2026-45598 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw allows an authorized local attacker to elevate privileges on affected Microsoft Windows desktop and server systems. Microsoft published the advisory on June 9, 2026, and the issue is tracked under CWE-362, indicating a concurrent execution race that leads to unsafe memory reuse. Successful exploitation grants the attacker SYSTEM-level execution from a low-privileged user context, undermining endpoint isolation and security boundaries on the host.
Critical Impact
Local attackers with valid credentials can win a race in afd.sys to reuse freed kernel memory and gain SYSTEM privileges across supported Windows 10, Windows 11, and Windows Server releases.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-06-09 - CVE-2026-45598 published to NVD with Microsoft advisory
- 2026-06-11 - Last updated in NVD database
Technical Details for CVE-2026-45598
Vulnerability Analysis
The Ancillary Function Driver for WinSock (afd.sys) is the kernel-mode component that brokers user-mode Winsock requests into the Windows networking stack. CVE-2026-45598 stems from a race condition [CWE-362] that produces a use-after-free condition on a kernel object managed by the driver. An attacker who issues two concurrent socket operations can cause one thread to free a structure while another continues to reference it.
Reusing the freed allocation with attacker-controlled data lets the adversary corrupt kernel memory in a controlled manner. From there, the attacker can pivot to arbitrary kernel read/write primitives, overwrite a token field, or hijack an IRP completion routine to execute code in ring 0. The CVSS vector indicates high attack complexity because the attacker must reliably win the race window inside the driver.
Root Cause
The root cause is missing synchronization around an object lifetime in afd.sys. Two code paths can operate on the same kernel allocation without holding consistent locks or reference counts. When one path releases the object while the other dereferences it, the dangling pointer references reusable pool memory.
Attack Vector
Exploitation requires local authenticated access. The attacker opens an AFD handle through standard Winsock APIs, then issues parallel IOCTLs or socket calls designed to trigger the race. Successful exploitation results in code execution in kernel mode and full compromise of confidentiality, integrity, and availability on the host. The vulnerability is not exploitable remotely and is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public proof-of-concept code has been released for CVE-2026-45598. Refer to the Microsoft Security Update CVE-2026-45598 advisory for vendor technical details.
Detection Methods for CVE-2026-45598
Indicators of Compromise
- Unexpected SYSTEM-context child processes spawned by standard user sessions shortly after Winsock-heavy activity.
- Kernel bugchecks referencing afd.sys (for example, BAD_POOL_CALLER or KERNEL_MODE_HEAP_CORRUPTION) that correlate with user-launched binaries.
- New service installations, scheduled tasks, or credential dumping tools immediately following local logons by non-administrative accounts.
Detection Strategies
- Hunt for processes that open raw handles to \Device\Afd and then rapidly issue concurrent DeviceIoControl calls from multiple threads.
- Correlate token integrity-level changes on existing processes with the absence of an authorized elevation event (UAC consent or service start).
- Alert on unsigned or low-reputation binaries followed by privileged operations such as registry edits under HKLM\SYSTEM\CurrentControlSet\Services.
Monitoring Recommendations
- Forward Windows kernel crash telemetry and Sysmon Event ID 1, 10, and 13 logs to a central analytics platform for correlation.
- Monitor for abnormal handle-open patterns against afd.sys from non-network applications.
- Track patch deployment status for the June 2026 cumulative updates across all Windows endpoints and servers.
How to Mitigate CVE-2026-45598
Immediate Actions Required
- Apply the June 2026 Microsoft security update referenced in the Microsoft Security Update CVE-2026-45598 advisory to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching on multi-user systems, jump hosts, and Remote Desktop Session Hosts where local privilege escalation has the highest impact.
- Audit local account membership and remove unnecessary interactive logon rights to reduce the population of users who can attempt exploitation.
Patch Information
Microsoft addressed CVE-2026-45598 in the June 2026 monthly security update. The fix is delivered through standard Windows Update channels, Windows Server Update Services (WSUS), and Microsoft Update Catalog packages. Administrators should verify that the corresponding KB is installed on every supported Windows 10, Windows 11, and Windows Server build listed in the affected products section.
Workarounds
- No vendor-supplied workaround exists; install the security update as soon as feasible.
- Restrict local logon and Remote Desktop access to trusted administrative accounts until patching is complete.
- Enforce application allowlisting (for example, Windows Defender Application Control) to block unsigned binaries from executing in user contexts.
# Verify the June 2026 cumulative update is installed (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Force a Windows Update scan and install on a single host
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
