CVE-2026-61348: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-61348 Overview

CVE-2026-61348 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. The issue is tracked under CWE-416 and carries a CVSS 3.1 base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Microsoft published the advisory in the Microsoft Security Update Guide. At publication, no public proof-of-concept, exploit code, or in-the-wild exploitation has been reported, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation allows a low-privileged local user to gain SYSTEM-level privileges, resulting in full confidentiality, integrity, and availability compromise of the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61348 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61348

Vulnerability Analysis

The flaw resides in the Ancillary Function Driver for WinSock (afd.sys), a kernel-mode driver that implements the WinSock user-mode socket API surface. The driver mishandles the lifetime of a heap-allocated object, freeing the memory while a reference to it remains reachable. An attacker who triggers reuse of the freed allocation can control kernel memory that the driver later dereferences.

Because afd.sys runs in kernel context, corrupting the reused object leads to controlled reads, writes, or function-pointer hijack primitives at ring 0. Attackers typically weaponize these primitives to overwrite process token fields or install a malicious kernel callback, resulting in SYSTEM-level execution from an unprivileged user session.

Root Cause

The root cause is a classic use-after-free condition [CWE-416]. The driver releases an object referenced through a socket-related IOCTL path without invalidating all outstanding references. A subsequent operation dereferences the stale pointer after the allocation has been reclaimed by an attacker-controlled object of the same size.

Attack Vector

Exploitation requires local access and authenticated, low-privilege execution on the target system (AV:L, PR:L). The attack complexity is high (AC:H), reflecting the race window and heap-grooming required to reliably reclaim the freed allocation. No user interaction is needed. The vulnerability manifests when the attacker issues a specific sequence of socket IOCTLs to \Device\Afd and wins the race that reuses the freed object before the driver dereferences it. See the Microsoft Security Update Guide for vendor-supplied technical context.

Detection Methods for CVE-2026-61348

Indicators of Compromise

Unexpected child processes of low-privilege user sessions running as NT AUTHORITY\SYSTEM shortly after socket-heavy activity.
System bugchecks referencing afd.sys or kernel pool corruption crashes on unpatched hosts.
Loading of unsigned or newly dropped kernel drivers immediately following local IOCTL activity against \Device\Afd.

Detection Strategies

Monitor for token manipulation patterns where a process token's PrivilegeCount or SID changes at runtime without a legitimate impersonation event.
Correlate Sysmon Event ID 10 (ProcessAccess) and Event ID 1 (ProcessCreate) to spot medium-integrity processes spawning high-integrity children without a UAC prompt.
Alert on kernel crashes with stop codes tied to pool corruption on hosts running vulnerable builds prior to the August 2026 update.

Monitoring Recommendations

Baseline WinSock IOCTL usage per process and flag statistical outliers issuing high-volume socket control calls from non-network applications.
Track EPSS movement for CVE-2026-61348 (currently 1.428% at the 70.6 percentile) and prioritize patch verification if the score rises.
Audit endpoints for missing August 2026 cumulative updates using centralized patch reporting.

How to Mitigate CVE-2026-61348

Immediate Actions Required

Deploy the August 2026 Microsoft security updates that address CVE-2026-61348 across all affected Windows client and server SKUs.
Inventory endpoints still running Windows 10 1607, 1809, and Windows Server 2012/2012 R2 to confirm they are covered by the appropriate Extended Security Update channel.
Restrict interactive and remote-shell access on multi-user systems to limit the pool of authenticated attackers able to reach afd.sys.

Patch Information

Microsoft has released fixes through its standard monthly servicing channels. Refer to the Microsoft Security Update Guide entry for the specific KB article and build numbers applicable to each Windows version listed in the Affected Products section.

Workarounds

No official workaround is provided by Microsoft; applying the security update is the supported remediation.
Enforce least privilege and remove local administrator rights from standard users to reduce the value of post-exploitation SYSTEM access.
Enable kernel-mode protections such as Hypervisor-Protected Code Integrity (HVCI) and Credential Guard to raise the cost of kernel exploitation on supported hardware.

bash

# Verify patch status on Windows via PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm afd.sys file version against the fixed build listed in MSRC
Get-Item C:\Windows\System32\drivers\afd.sys | Select-Object VersionInfo