Microsoft Windows AFD for WinSock: Use-after-free privilege escalation

Summary

A use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD), the kernel driver behind Winsock network I/O, allows local privilege escalation. An attacker with low privileges and an existing foothold on the system can gain higher privileges, which can lead to full compromise of the host. Attack complexity is high and no user interaction is required. The flaw is not remotely exploitable on its own.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see MSRC for build ranges)
• Windows Server 2012 and 2012 R2 (incl. Server Core): see MSRC for build ranges
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later (October 2026 security update)
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 10 Version 21H2: build 10.0.19044.7807 or later
• Windows 10 Version 22H2: build 10.0.19045.7807 or later
• The KB number for Windows 10 Version 1607 is unknown; check the Microsoft Security Update Guide entry.

Workaround

Unknown. No vendor workaround was found; the security update is the fix.

Exploitation

• CISA KEV: not listed
• Public proof of concept: none found
• CISA SSVC: exploitation none, automatable no, technical impact total
• EPSS: 0.00326 (low)
• No in-the-wild exploitation was found for this CVE. A different AFD flaw, CVE-2026-68820, is listed in CISA KEV.

Our recommendation

• Install the October 2026 security update on all affected Windows systems, prioritising multi-user servers, RDS hosts and shared workstations.
• Check whether Windows 10 Version 1607 is still supported and plan an upgrade if it is not.
• Verify that CVE-2026-68820 (AFD, exploited in the wild) is also patched; the August 2026 cumulative update covers it.
• Limit local logon and the execution of untrusted code on servers and workstations, because the attacker needs an existing low-privilege foothold.
• Monitor for unusual privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70237 msrc.microsoft.com
• OpenCVE: CVE-2026-70237 app.opencve.io
• Vulners NVD record: CVE-2026-70237 vulners.com
• Vulners CVelist record: CVE-2026-70237 vulners.com
• SonicWall: Microsoft October 2026 security bulletin coverage www.sonicwall.com
• Red Legg: Local privilege escalation in Windows AFD (related CVE-2026-68820) www.redlegg.com
• Helix threat watch: CVE-2026-68820 helix.ml
• Strix: CVE-2026-70237 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:58.