CVE-2026-45638 Overview
CVE-2026-45638 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw allows an authenticated local attacker to elevate privileges on an affected system. Successful exploitation can grant SYSTEM-level access from a low-privileged user context.
The vulnerability is tracked under CWE-122 and affects a kernel-mode driver that brokers Winsock requests between user-mode applications and the underlying transport stack. Microsoft published technical guidance in the Microsoft Security Update Guide.
Critical Impact
Local privilege escalation to SYSTEM through a kernel driver use-after-free, enabling full control over the affected Windows host.
Affected Products
- Microsoft Windows (Ancillary Function Driver for WinSock, afd.sys)
- Refer to the Microsoft Security Update Guide for the full list of impacted Windows builds
- All supported Windows versions shipping the vulnerable driver until patched
Discovery Timeline
- 2026-06-09 - CVE-2026-45638 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45638
Vulnerability Analysis
The Ancillary Function Driver for WinSock (afd.sys) is a kernel-mode driver that implements the Winsock kernel interface. It handles socket I/O requests issued by user-mode processes through the Windows Sockets API. A use-after-free condition in this driver allows reuse of a freed kernel object while a stale reference is still active.
An authorized local attacker can trigger the dangling reference by issuing a crafted sequence of socket operations. When the driver dereferences the freed object, the attacker can substitute attacker-controlled data in the same allocation slot. This primitive enables arbitrary kernel memory corruption.
Because afd.sys runs in ring 0, manipulation of freed objects can be converted into kernel code execution or token replacement, yielding SYSTEM privileges. The attack is local and requires only low-privileged authentication, with no user interaction.
Root Cause
The root cause is improper lifetime management of a heap-allocated kernel object inside afd.sys, classified as [CWE-122] heap-based memory corruption realized through a use-after-free. The driver releases an object but retains a reference that is later dereferenced during socket processing. Race conditions between concurrent socket operations make the window reliably reachable from user mode.
Attack Vector
Exploitation requires local access and valid credentials on the target host. The attacker calls Winsock APIs that descend into afd.sys and orchestrates allocation, free, and reuse of the vulnerable object. After reclaiming the freed allocation with controlled data, the attacker pivots to a write-what-where primitive and overwrites the process token or kernel function pointers.
No network access and no user interaction are required, making this vector well-suited to post-compromise privilege escalation chains following initial access through phishing, malicious loaders, or compromised low-privilege services.
No public proof-of-concept code is available at the time of publication. Refer to the Microsoft Security Update Guide for vendor technical detail.
Detection Methods for CVE-2026-45638
Indicators of Compromise
- Unexpected SYSTEM-level child processes spawned from low-privileged user sessions
- Kernel crashes or bug checks referencing afd.sys on hosts where the patch has not been applied
- Anomalous loading of unsigned drivers or token manipulation events shortly after Winsock-heavy activity
Detection Strategies
- Hunt for processes that suddenly acquire SYSTEM or elevated tokens without a corresponding service or scheduled task origin
- Correlate Sysmon Event ID 1 and Windows Security Event ID 4688 with parent-child mismatches involving non-elevated parents producing elevated children
- Monitor for crash dumps and Event ID 1001 (BugCheck) entries implicating afd.sys
Monitoring Recommendations
- Enable kernel-mode driver telemetry and ensure Windows Defender Application Control or equivalent policies block unsigned driver loads
- Track patch deployment status for the June 2026 Windows security updates across managed endpoints
- Alert on local logon sessions executing tools that perform unusual WSAIoctl or raw socket allocation patterns
How to Mitigate CVE-2026-45638
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows hosts
- Prioritize patching of multi-user systems, jump hosts, and developer workstations where low-privileged accounts execute untrusted code
- Audit local account inventory and remove unnecessary interactive logon rights to reduce the pool of potential attackers
Patch Information
Microsoft has issued an official fix through the Microsoft Security Update Guide. Deploy the relevant cumulative update for the Windows version in use. The patch corrects the object lifetime handling in afd.sys that produces the use-after-free condition.
Workarounds
- No vendor-supplied workaround replaces the patch; install the update as the primary mitigation
- Restrict local logon and remote interactive sessions to trusted administrators where patching is delayed
- Enforce application control to block execution of unknown binaries that could deliver an exploit payload
# Verify the patch level on a Windows host
wmic qfe list brief /format:table
# PowerShell: confirm afd.sys file version after patching
Get-Item C:\Windows\System32\drivers\afd.sys | Select-Object VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
