Windows Ancillary Function Driver for WinSock: Use after free, privilege escalation

Summary

A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock allows a locally authorized attacker to elevate privileges. An attacker needs an existing low-privileged foothold, such as a phished user account, malware, or a compromised account on a shared or terminal server. Microsoft rates the issue Important with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L).

Affected

• Windows 10 Version 1607 (x64 and 32-bit), builds before 10.0.14393.9612
• Windows 10 Version 1809, builds before 10.0.17763.9376
• Windows 10 Version 21H2, builds before 10.0.19044.7807
• Windows 10 Version 22H2, builds before 10.0.19045.7807
• Windows 11 Version 23H2, builds before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, builds before 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1, builds before 10.0.28000.3231
• Windows 11 Version 26H2, builds before 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core), builds before 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2016, builds before 10.0.14393.9612

Fixed in

• Windows 10 1607: update to OS Build 14393.9612 or later (October 13, 2026 cumulative update, KB5126868; verify in the MSRC guide)
• Other versions: October 2026 security updates as listed in the MSRC Security Update Guide
• The out-of-band update KB5134123 (OS Build 14393.9615) is a non-security update and is not confirmed as the fix

Workaround

Unknown.

Exploitation

• Microsoft lists the vulnerability as not publicly disclosed and not exploited
• Not in the CISA KEV catalog; CISA SSVC lists exploitation as none and automatable as no
• EPSS score about 0.0022 (low)
• No public proof of concept found

Our recommendation

• Inventory all Windows systems, especially Windows 10 1607, LTSB 2016 and Windows Server 2012, 2012 R2 and 2016
• Install the October 2026 security updates on all supported systems as a priority on multi-user, terminal and server systems
• Verify the fix for Windows 10 1607 in the MSRC guide before rollout
• Plan migration for 1607 systems that cannot receive updates, since their lifecycle has ended
• Limit local logon rights and monitor for privilege escalation on critical systems

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83738 msrc.microsoft.com
• NVD record via Vulners vulners.com
• KB5126868 Windows 10 1607 security update support.microsoft.com
• KB5134123 Windows 10 1607 update (out-of-band) support.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• OpenCVE CVE-2026-83738 app.opencve.io
• Rapid7 via Vulners (EPSS) vulners.com
• SonicWall October 2026 Microsoft coverage www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:23.