Windows Ancillary Function Driver for WinSock: Local privilege escalation

Summary

A type confusion flaw (CWE-843) in the Windows Ancillary Function Driver for WinSock, part of the Windows networking stack, allows an authorized local user to elevate privileges. Successful exploitation can give an attacker full control of the affected system (CVSS 7.8, high impact on confidentiality, integrity and availability). The attacker needs a local foothold with low privileges and is not directly reachable from the internet. Windows 10 Version 1607 and Windows Server 2016 are among the affected products.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (before 10.0.17763.9376)
• Windows 10 Version 21H2 (before 10.0.19044.7807)
• Windows 10 Version 22H2 (before 10.0.19045.7807)
• Windows 11 Version 23H2 (before 10.0.22631.7652)
• Windows 11 Version 24H2 (before 10.0.26100.9711)
• Windows 11 Version 25H2 (before 10.0.26200.9711)
• Windows 11 Version 26H1 (before 10.0.28000.3231)
• Windows 11 Version 26H2 (before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (see MSRC for the exact builds)

Fixed in

• Windows 10 Version 1607 and Server 2016: 10.0.14393.9612 or later
• Other versions: the build listed above for each version or later
• Reported as part of the October 2026 cumulative update KB5126868 for Windows 10 1607 (not verified against MSRC)

Workaround

Unknown. A third-party aggregator suggests disabling the driver, but this is unverified and would likely break network connectivity. Do not apply it without testing and vendor confirmation.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV (per third-party aggregator)
• No public proof of concept or in-the-wild exploitation found (not confirmed absent)

Our recommendation

• Inventory all Windows hosts, especially Windows 10 1607 and Server 2016.
• Install the October 2026 security update after a pilot test.
• Plan migration off Windows 10 Enterprise LTSB 2016, which reached end of updates on October 13, 2026, or budget for Extended Security Updates for hosts that cannot be patched.
• Restrict local low-privilege code execution and monitor for suspicious local privilege changes.
• Verify the affected-version table on the MSRC page before relying on it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70225 msrc.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• NVD record mirror (Vulners) vulners.com
• OpenCVE CVE-2026-70225 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:57.