Microsoft patched a critical local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys) on June 9, 2026, as part of its monthly Patch Tuesday updates. Tracked as CVE-2026-45638, the flaw earned a CVSS score of 7.8 and an “Important” severity rating. Successful exploitation could allow an authenticated attacker to execute code with SYSTEM privileges—the highest level on a Windows machine.
The bug resides in how the AFD driver handles specially crafted input from user-mode applications. Microsoft acknowledged that an attacker with low privileges could trigger a race condition or memory corruption, leading to an elevation of privilege. With SYSTEM access, an attacker could install programs, view or alter data, and create new accounts with full user rights.
What is the Windows WinSock AFD Driver?
The Ancillary Function Driver for WinSock (afd.sys) is a kernel-mode driver that serves as the gateway between user-mode socket APIs and the lower-level transport protocols. It handles operations like socket creation, binding, and data transfer for Windows Sockets applications. Because it operates in the kernel, any vulnerability within afd.sys can have severe security implications, breaking out of user-mode sandboxes and bypassing security boundaries.
The driver is loaded by default on all Windows installations and is constantly listening for requests from any process that uses network sockets. Attackers routinely target drivers like afd.sys because they are present on every Windows system and often contain legacy code or complex logic that can harbor subtle bugs.
Vulnerability Analysis and Attack Vector
CVE-2026-45638 is a local privilege escalation, meaning an attacker must already have a foothold on the target system. However, the bar is low—any low‑integrity process (e.g., a sandboxed browser renderer, a compromised user account, or malware that gained initial code execution) can leverage the flaw to escalate to SYSTEM.
Microsoft’s advisory notes that the vulnerability does not require user interaction and has a low attack complexity. An attacker would craft a malicious application that sends carefully crafted IOCTL (Input/Output Control) requests to afd.sys. The driver fails to properly validate a buffer or synchronization object under certain race conditions, leading to a write-what-where primitive or a direct kernel memory corruption. From there, the attacker can overwrite a function pointer or process token to gain SYSTEM privileges.
Public exploit details were not available at the time of the patch, but the nature of the bug makes it a prime candidate for integration into malware kits and red-team tools. Kernel driver vulnerabilities that allow local privilege escalation are highly sought after because they can break out of containers, Hyper‑V isolated environments, and other forms of application sandboxes.
Affected Systems
The security advisory lists Windows 10 (1607 through 22H2), Windows 11 (21H2 through 24H2), and Windows Server 2016 through 2025 as affected. Versions that reached end of service, like older LTSC releases, are not explicitly listed but may still be vulnerable; Microsoft typically only provides updates for in‑support editions.
Administrators should verify whether their specific build number is included. The patch was delivered via Windows Update, WSUS, and the Microsoft Update Catalog. KB article references were provided in the advisory for each affected version.
Severity and Real‑World Impact
Microsoft uses the “Important” severity rating for vulnerabilities that could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources. The company typically reserves “Critical” for remote code execution flaws, especially those that are wormable.
But for defenders, any kernel privilege escalation is effectively critical. Once an attacker achieves SYSTEM, they can disable endpoint protection, dump credentials, move laterally, and establish persistence. The CVSS 7.8 score reflects the high impact on confidentiality, integrity, and availability, tempered by the requirement for local access and low privileges.
Practically, the real‑world risk is heightened for organizations that allow unprivileged users to run arbitrary code (e.g., developer workstations, shared terminal servers) or that rely on container isolation as a primary security boundary.
Patch Tuesday Context
June 2026’s Patch Tuesday addressed a total of 72 vulnerabilities, three of which were rated Critical. CVE-2026-45638 was one of six privilege‑elevation flaws fixed in the Windows kernel and drivers. The update bundle also included patches for Microsoft Edge, Office, Exchange Server, and Azure services.
Microsoft tracked the bug back to a missing input validation in a newly added IOCTL handler. The engineers added proper bounds checks and refactored the synchronization mechanism to eliminate the race condition. As is standard, the advisory credits independent security researchers who reported the issue through the MSRC coordinated vulnerability disclosure program.
Mitigation and Workarounds
Microsoft did not provide any practical workaround. Disabling the WinSock AFD driver is not viable—it would break all socket‑based communication on the system, including critical Windows services. Similarly, blocking specific IOCTL codes requires custom filter drivers that are complex to deploy and maintain.
The only effective mitigation is applying the security update. Organizations that cannot immediately patch should prioritize restricting local access, implementing least‑privilege principles, and monitoring for anomalous driver interactions using endpoint detection and response (EDR) tools.
Deployment Guidance
Administrators should deploy the update as part of their regular Patch Tuesday cycle. The June 2026 update is cumulative, so it includes all prior security fixes. Reboot is required. For enterprise networks, Microsoft recommends testing on a representative set of devices before broad deployment.
Virtualized environments and Azure‑hosted machines receive the patch through their normal update channels. Windows 365 Cloud PCs are already protected if automatic updates are enabled.
Historical Perspective
Kernel privilege escalation vulnerabilities in the Windows socket subsystem are not new. In 2020, CVE‑2020‑16898, a “Bad Neighbor” vulnerability in the TCP/IP stack, allowed remote code execution via carefully crafted ICMPv6 Router Advertisement packets. While that was remote, local escalations in afd.sys have appeared multiple times over the years—CVE‑2018‑12130 and CVE‑2017‑0143, for instance, both targeted the same driver.
The persistence of such bugs underscores the challenge of securing kernel-mode code written decades ago, often in C, without modern safety features. Microsoft’s ongoing efforts to rewrite parts of the Windows kernel in Rust aim to eliminate entire classes of memory‑safety bugs, but legacy drivers like afd.sys will likely remain a target for years.
Community Reaction and Discussion
On the WindowsForum thread for CVE‑2026‑45638, user TechAdmin42 noted that their organization’s endpoint detection system began flagging suspicious afd.sys interactions weeks before the patch, hinting that advanced threats may have already been probing the vulnerability. Another user, NetDefender, pointed out that many third‑party security tools hook into the same driver, complicating exploit detection.
Sysinternals fan asked whether the bug could be triggered from a low‑integrity AppContainer process. According to Microsoft’s advisory, yes—attack complexity is low and no special privileges are needed. This makes the flaw especially dangerous for environments that rely on AppContainer sandboxing (e.g., Edge legacy processes).
The discussion also surfaced concerns about server deployments where automatic reboots are not permitted during business hours; some admins debated using PowerShell’s Restart‑Computer with scheduled tasks to minimize downtime.
Looking Ahead
CVE‑2026‑45638 is a sharp reminder that local privilege escalation remains a cornerstone of modern attack chains. While the industry often focuses on remote zero‑day exploits, the vast majority of ransomware incidents and data breaches escalate from a local foothold.
Microsoft’s monthly cadence and the increasing transparency of its advisory program help defenders prioritize. Yet the ultimate safeguard is the discipline to apply updates quickly and to design networks that assume compromise. For Windows administrators, June’s patch should be deployed without delay—the next attacker is already reverse‑engineering the fix.