Quick Look: CVE-2026-35416 — Use After Free in Windows WinSock Driver Enables Local Privilege Escalation

Introduction

CVE-2026-35416 is a race condition in the Windows Ancillary Function Driver for WinSock (afd.sys), one of the most fundamental kernel drivers on any Windows system, and it gives a low-privileged local account a viable path to SYSTEM. afd.sys is involved in every networking operation on Windows. A successful exploit grants full local privilege escalation.

Microsoft fixed it in the May 2026 Patch Tuesday release. It has a CVSS 3.1 base score of 7.0, and Microsoft rates it "Exploitation More Likely." It is a kernel-level use after free, it affects 31 distinct Windows configurations, and the vulnerability class is well understood. Put it near the top of your next patch cycle.

Technical Information

Root Cause: Use After Free in afd.sys

The vulnerability is classified under CWE-416 (Use After Free). The affected component is afd.sys, the Windows Ancillary Function Driver for WinSock. It is a kernel-mode driver that manages WinSock operations and acts as the bridge between user-mode socket calls and the underlying transport layer. Every Windows system with networking enabled loads this driver.

The driver references memory after that memory has been deallocated. The use after free arises during concurrent operations within the driver, which creates a race window. The CVSS vector reflects this with an Attack Complexity of High (AC:H), meaning exploitation is not trivial and the attacker has to win a timing-dependent race condition.

Because afd.sys is a closed-source Windows kernel component, Microsoft does not publish source-level diffs. The fix ships as a binary update to the driver through cumulative and hotpatch updates. According to the MSRC advisory, the patch corrects object lifetime management within the WinSock ancillary function driver so that freed memory is no longer accessible during concurrent operations, which closes the race window.

CVSS Vector Breakdown

The full CVSS 3.1 vector breaks down as follows:

Attack Flow

Based on the available technical details, exploitation follows this general sequence:

1. Initial Access: The attacker obtains a low-privileged local session on the target Windows system. This could come from an interactive logon, SSH, or any other mechanism that provides read, write, and execute capabilities on the host.

2. Triggering the Race Condition: The attacker issues carefully timed WinSock operations through the afd.sys driver interface. The goal is for one thread to free a memory object while another thread still holds a reference to it.

3. Exploiting the Dangling Reference: Once the race is won, the attacker manipulates the freed memory region, possibly replacing it with attacker-controlled data. In a kernel context, this kind of corruption can be used to hijack execution flow or overwrite security tokens.

4. Privilege Escalation: Successful exploitation results in code execution at SYSTEM level, giving the attacker complete control over the host. The High impact ratings for confidentiality, integrity, and availability confirm this outcome.

The attack needs no user interaction, so it suits post-compromise automation once an attacker has an initial foothold.

Researcher Credit

Angelboy (@scwuaptx) of DEVCORE responsibly disclosed the vulnerability.

Patch Information

Microsoft released an official fix for CVE-2026-35416 on May 12, 2026, as part of its regular Patch Tuesday cycle. The MSRC advisory lists the remediation level as Official Fix and the exploit code maturity as Unproven at the time of publication.

As described above, the patch corrects object lifetime management within the WinSock ancillary function driver so that freed memory is no longer accessible during concurrent operations.

Affected products span client and server editions of Windows. These are the key KB articles by product family:

On Windows Server 2025 Datacenter Azure Edition and Windows 11 Enterprise with Hotpatch enabled, the fix is also available through hotpatch delivery (e.g., KB5087423, KB5089466), so the security update can be applied without a reboot. For production servers with tight downtime windows, that is a significant operational advantage.

All other deployments can get the standard cumulative updates through Windows Update, WSUS, and the Microsoft Update Catalog. Microsoft documents no official workarounds. Patching is the only supported remediation.

Compensating Controls

Patching remains the definitive fix, but network intrusion detection vendors have released coverage that may provide interim visibility:

• Snort published subscriber rules on May 12, 2026, referencing this coding deficiency.
• Check Point released protection advisory CPAI-2026-4385 for their Security Gateway products.

Affected Systems and Versions

The vulnerability affects a wide range of Windows client and server operating systems. This is the complete list of affected configurations:

Windows Client:

• Windows 11 Version 26H1 (ARM64, x64)
• Windows 11 Version 25H2 (ARM64, x64)
• Windows 11 Version 24H2 (ARM64, x64)
• Windows 11 Version 23H2 (ARM64, x64)
• Windows 10 Version 22H2 (32 bit, ARM64, x64)
• Windows 10 Version 21H2 (32 bit, ARM64, x64)
• Windows 10 Version 1809 (32 bit, x64)
• Windows 10 Version 1607 (32 bit, x64)

Windows Server:

• Windows Server 2025 (Server Core installation and Desktop Experience)
• Windows Server 2022, 23H2 Edition (Server Core installation)
• Windows Server 2022 (Server Core installation and Desktop Experience)
• Windows Server 2019 (Server Core installation and Desktop Experience)
• Windows Server 2016 (Server Core installation and Desktop Experience)
• Windows Server 2012 R2 (Server Core installation and Desktop Experience)
• Windows Server 2012 (Server Core installation and Desktop Experience)

In total, Microsoft lists 31 distinct affected configurations. Microsoft rates the maximum severity as Important across all affected products.

Vendor Security History

The afd.sys driver has been a recurring target for privilege escalation research. The May 2026 Patch Tuesday also addressed CVE-2026-34345, another elevation of privilege vulnerability in the same afd.sys WinSock driver, so researchers are still paying close attention to this component. The full May 2026 Patch Tuesday release addressed 120 vulnerabilities, with no zero-days exploited in the wild during this cycle.

References

• NVD Entry for CVE-2026-35416
• MSRC Security Update Guide: CVE-2026-35416
• Microsoft Support: KB5087539
• Microsoft Support: KB5087423
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Snort Subscriber Rules Update 2026-05-12
• Check Point Advisory CPAI-2026-4385
• VulDB Entry for CVE-2026-35416
• Windows Forum: CVE-2026-34345 AFD.sys WinSock EoP Fix
• Desktop Operating System Market Share Worldwide (StatCounter)