Microsoft Windows: Use-after-free in Ancillary Function Driver for WinSock

Summary

The Windows Ancillary Function Driver for WinSock (AFD) contains a use-after-free flaw that allows a local attacker to elevate privileges. The attacker needs a valid low-privileged account or code execution on the host and must win a race condition (high attack complexity). The CVSS vector shows no remote attack path.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9688 or later
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9487 or later
• Windows 10 21H2: 10.0.19044.7846 or later
• Windows 10 22H2: 10.0.19045.7846 or later
• Windows Server 2022: 10.0.20348.5870 or later
• Windows 11 23H2: 10.0.22631.7711 or later
• Windows 11 24H2: 10.0.26100.9974 or later
• Windows 11 25H2: 10.0.26200.9974 or later
• Windows 11 26H1: 10.0.28000.3501 or later
• Windows 11 26H2: 10.0.26300.9974 or later

The fixed builds come from the CVE record and must be confirmed on the MSRC advisory. KB numbers: Unknown.

Workaround

Unknown. No vendor-documented workaround identified; apply the security update.

Exploitation

• Exploited in the wild: Unknown. Talos reports a Microsoft note about one exploited vulnerability in November 2026 but does not clearly identify it; check the MSRC Exploitability section.
• CISA SSVC assessment: Exploitation none, not automatable, total technical impact.
• Public proof of concept: none found.

Our recommendation

• Install the November 2026 Windows cumulative update on all affected hosts, starting with multi-user terminal, RDP and file/print servers.
• Verify installed builds against the fixed builds above and the MSRC advisory.
• Restrict local logon and shell access on servers and monitor for suspicious local privilege escalation.
• Confirm that the AFD-related fixes from the August 2026 update are also installed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide (CVE-2026-88242) msrc.microsoft.com
• MSRC Security Update Guide (en-US) msrc.microsoft.com
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• Strix: CVE-2026-88242 (third-party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:11.