CVE-2026-45601: Windows WinSock Driver Privilege Escalation

CVE-2026-45601 Overview

CVE-2026-45601 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw allows an authorized local attacker to elevate privileges on an affected system. The vulnerability is associated with [CWE-362], a concurrent execution race condition leading to improper memory state. Exploitation requires local access and low privileges, with no user interaction needed. Successful exploitation grants high impact on confidentiality, integrity, and availability. Microsoft tracks this issue in its Security Update Guide.

Critical Impact
A local authenticated attacker can win a race condition in afd.sys to trigger a use-after-free, gaining SYSTEM-level privileges on the host.

Affected Products

Microsoft Windows (Ancillary Function Driver for WinSock — afd.sys)
Specific affected builds: refer to the Microsoft Security Update Guide
Server and client editions running the vulnerable driver

Discovery Timeline

2026-06-09 - CVE-2026-45601 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45601

Vulnerability Analysis

The Ancillary Function Driver for WinSock (afd.sys) is a kernel-mode driver that exposes socket functionality to user-mode applications through the Windows Sockets API. The driver maintains kernel objects that track per-socket state across asynchronous I/O operations. The vulnerability allows a local attacker holding standard user privileges to manipulate this state so a freed object is reused, yielding kernel memory corruption and privilege escalation.

The CWE-362 classification indicates a race condition. Concurrent threads operate on shared afd.sys structures without adequate synchronization, allowing one thread to free an object while another retains and dereferences a stale pointer. The attack complexity is rated high because the attacker must reliably win this race window.

Root Cause

The root cause is improper synchronization between concurrent operations on a shared kernel object in afd.sys. A reference to the object survives the deallocation path, and a follow-up call dereferences the dangling pointer. Attackers reclaim the freed allocation with controlled data to hijack execution or corrupt adjacent kernel state.

Attack Vector

Exploitation requires code execution as a low-privileged local user. The attacker issues concurrent socket-related system calls to afd.sys to trigger the race. After the use-after-free fires, the attacker sprays the kernel pool to occupy the freed slot, then steers kernel control flow or token data to gain SYSTEM privileges. No network access or user interaction is required.

No public exploit code or proof-of-concept has been published for CVE-2026-45601 at the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the Microsoft Security Update Guide entry for CVE-2026-45601.

Detection Methods for CVE-2026-45601

Indicators of Compromise

Unexpected SYSTEM-level processes spawned from user-context parents shortly after a burst of socket-related syscalls.
Kernel bugchecks referencing afd.sys (for example, BAD_POOL_HEADER or KERNEL_MODE_HEAP_CORRUPTION) coinciding with user-mode workloads.
Unsigned or LOLBin binaries calling WinSock APIs in tight loops from non-network applications.

Detection Strategies

Monitor for token manipulation patterns where a non-administrative process suddenly assumes SYSTEM token attributes.
Hunt for process trees where an unprivileged process is followed by privileged child processes without legitimate UAC elevation events.
Correlate Windows Event ID 4672 (special privileges assigned) with parent processes that should not hold those privileges.

Monitoring Recommendations

Enable kernel-mode crash dump collection and forward MiniDump files to a central analysis pipeline.
Ingest Sysmon Event IDs 1, 10, and 25 into a SIEM to surface anomalous handle access and process integrity changes.
Track patch compliance on the afd.sys driver across all Windows endpoints and servers.

How to Mitigate CVE-2026-45601

Immediate Actions Required

Apply the Microsoft security update referenced in the Security Update Guide for CVE-2026-45601 on all Windows hosts.
Inventory endpoints by afd.sys file version to confirm patch deployment coverage.
Restrict the ability of untrusted users to execute arbitrary code on affected systems pending patching.

Patch Information

Microsoft has issued a fix through its standard servicing channels. Administrators should consult the Microsoft Security Update Guide for the exact KB article and updated afd.sys build numbers applicable to each supported Windows release. Apply updates through Windows Update, WSUS, Microsoft Update Catalog, or Intune as appropriate.

Workarounds

No vendor-supplied workaround replaces the official patch; prioritize installing the security update.
Reduce local attack surface by enforcing least privilege and removing unnecessary interactive logon rights on multi-user systems.
Apply application allowlisting (for example, Windows Defender Application Control) to block unauthorized binaries from executing socket-abuse code.

bash

# Verify the installed afd.sys version on a Windows host
Get-Item C:\Windows\System32\drivers\afd.sys |
  Select-Object Name, @{Name='FileVersion';Expression={$_.VersionInfo.FileVersion}}

# List installed security updates to confirm the relevant KB is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending