OnlyPatch
Windows Ancillary Function Driver for WinSock

CVE-2026-21241 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.02491 🔬 Patch diffed 2026-02 archive

Executive Summary

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Feb 10 2026
Last Updated Feb 10 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.02491 — 0.82969 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.02491
probability of exploitation in the next 30 days
0.82969 percentile - updated 2026-07-25
View on FIRST.org

Affected Products

5 affected products
Product KB Article Severity Impact Restart Required
Windows 11 Version 23H2 for ARM64-based Systems 5075941 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5075941 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5073379 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.7840 10.0.26100.7781 Yes None Windows 11 Version 24H2 for x64-based Systems 5077212 (Security Hotpatch Update) 5077181 (Security Update) Important Elevation of Privilege 5074109 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.7781 10.0.26100.7840 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5074109 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 25H2 for x64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5074109 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5077179 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5077179 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5075906 (Security Update) 5075943 (Security Hotpatch Update) Important Elevation of Privilege 5073457 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4773 10.0.20348.4711 Yes None Windows Server 2022 (Server Core installation) 5075906 (Security Update) 5075943 (Security Hotpatch Update) Important Elevation of Privilege 5073457 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4773 10.0.20348.4711 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5075897 (Security Update) Important Elevation of Privilege Yes

Patches

3 patches
Article Type Restart
5075941 Security Update Yes
5077179 Security Update Yes
5075897 Security Update Yes

Patch Diff

ghidriff · afd.sys (KB5077181)

Patch diff 10.0.26100.7623 -> 10.0.26100.7824

Pre-patch version 10.0.26100.7623 Download
Post-patch version 10.0.26100.7824 Download
Function Address Change Note
AfdBReceive 14003f640 -> 14003e810 code, length, address, called similarity 0.63
NTOSKRNL.EXE::MmMapLockedPages EXTERNAL:000000d5 -> EXTERNAL:000000d6 refcount, address similarity 1.0
AfdNotifyPostEvents 14005364c -> 140053cac code, length, address, called similarity 0.39
memcpy 140074980 -> 140075200 refcount, address similarity 1.0
AfdFastDatagramReceive 140033850 -> 140032940 code, length, address, called similarity 0.6
AfdTdiCreateAO 14002c650 -> 14002b6a0 code, length, sig, address, called similarity 0.92
AfdNotifyDestroyContext 14005349c -> 140053adc code, length, address, called similarity 0.67
AfdCleanupCore 140013870 -> 1400135a0 code, length, address, called similarity 0.67
AfdTransmitPackets 140043d30 -> 140044100 code, length, address, called similarity 0.41
AfdBCommonChainedReceiveEventHandler 14001a380 -> 140019340 code, length, address, called similarity 0.98
AfdSuperAccept 14002a310 -> 140029300 code, length, address, called similarity 0.26
AfdSanConnectHandler 14005c570 -> 14005cc50 code, length, address, called similarity 0.29
AfdRestartSuperAcceptGetAddress 14004a7e0 -> 14004ae30 code, length, address, called similarity 0.98
AfdCloseCore 140006ac8 -> 1400150c0 code, length, address, called similarity 0.17
wil_details_IsEnabledFallback 14004b4c8 -> 14004bab4 refcount, address, calling similarity 1.0
AfdReceiveDatagram 14003dec0 -> 14003d010 code, length, address, called similarity 0.67
AfdSanAcceptCore 140044f40 -> 1400453bc code, length, address, called similarity 0.19
__security_check_cookie 140074850 -> 1400750c0 refcount, address, calling similarity 1.0
AfdNotifyProcessRegistration 14005390c -> 140053fb8 code, length, address, called similarity 0.48
AfdExtractAfdSendMsgInfo 1400422a0 -> 1400415b0 code, length, address, called similarity 0.41
__C_specific_handler 140049fdd -> 14004a62d refcount, address similarity 0.89
AfdCompleteBufferedSendsUnlock 140005230 code, length, called similarity 0.48
AfdFastConnectionSend 140032e60 -> 140031ef0 code, length, address, called similarity 0.7
AfdFastConnectionReceive 140031ef0 -> 140030f00 code, length, address, called similarity 0.5
__GSHandlerCheck_SEH 1400747b4 -> 140075024 refcount, address similarity 1.0
NTOSKRNL.EXE::ExFreePoolWithTag EXTERNAL:000000f5 -> EXTERNAL:000000f6 refcount, address, calling similarity 1.0
AfdQueryHandles 14003a350 -> 140039510 code, length, sig, address, called similarity 0.63
AfdBind 14002acb0 -> 140029c70 code, length, address, called similarity 0.1
AfdFastDatagramSend 140034280 -> 1400333d0 code, length, address, called similarity 0.41
Feature_2829529401__private_IsEnabledDeviceUsageNoInline 14004acf0 -> 14004c900 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_447951161__private_IsEnabledDeviceUsageNoInline 14004acf0 -> 14004d200 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_TCPIP_2025_Wave4_AfdTransmit_MSRC__private_IsEnabledDeviceUsageNoInline 14004acf0 -> 14005bd78 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3923194169__private_IsEnabledDeviceUsageNoInline 14004acf0 -> 140060620 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2829529401__private_IsEnabledDeviceUsageNoInline 14004c310 -> 14004c900 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_447951161__private_IsEnabledDeviceUsageNoInline 14004c310 -> 14004d200 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_TCPIP_2025_Wave4_AfdTransmit_MSRC__private_IsEnabledDeviceUsageNoInline 14004c310 -> 14005bd78 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3923194169__private_IsEnabledDeviceUsageNoInline 14004c310 -> 140060620 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_447951161__private_IsEnabledDeviceUsageNoInline 140056c40 -> 14004d200 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3923194169__private_IsEnabledDeviceUsageNoInline 140056c40 -> 140060620 name, fullname, refcount, sig, address, calling, called similarity 0.71
View full diff report View RCA report Download PoC

Known Exploits

Acknowledgments

Souhail Hammou

On This Page