Microsoft has patched a privilege escalation flaw in the Windows Ancillary Function Driver (AFD) that could allow an attacker with local access to gain SYSTEM-level control of an unpatched machine. Tracked as CVE-2026-20810, the vulnerability stems from how the kernel-mode driver handles memory, creating a path for ordinary users to hijack the operating system.

The Vulnerability, Simply Put

At the core of Windows networking sits afd.sys—the kernel driver that backs Winsock, the API every application uses to send and receive data over TCP/IP, UDP, and other protocols. On Patch Tuesday, Microsoft’s Security Update Guide disclosed that this driver contains a defect where it “frees memory not on the heap.” That technical phrasing translates to a dangerous memory-corruption condition: the driver deallocates a chunk of memory it shouldn’t, which can corrupt kernel data structures and ultimately let an attacker run arbitrary code with the highest privileges.

An attacker who already has a foothold on a system—whether through a phishing lure, malicious document, or compromised user account—can trigger the bug by issuing specially crafted network-related calls or I/O control codes to the driver. Once exploited, the flaw turns a low-privilege process into a SYSTEM-level process, effectively handing the keys to the entire machine.

Microsoft has released updates that address the root cause. The exact patch details—KB numbers and file versions—vary by Windows edition and are enumerated in the official Security Update Guide, which should be your first stop for deployment planning.

What This Means for You

For Home Users

If you run Windows 10, Windows 11, or a supported server edition at home, this fix will arrive through Windows Update. Because the attack requires someone to already be running code on your PC, the immediate risk to most standalone users is moderate. That said, the ubiquity of afd.sys means every device is technically vulnerable, and the fix closes a door that malware often tries to pry open.

Action: Open Settings > Windows Update, check for updates, and install all critical and security patches. A reboot will be required.

For IT Administrators

This is a high-priority patch for enterprise environments. Local privilege escalation bugs are the linchpin of modern attack chains: after an attacker lands a toehold via a compromised account or endpoint, they immediately look for ways to climb to SYSTEM. AFD vulnerabilities have been actively weaponized in the past, and because the driver runs on every Windows machine, the blast radius is wide.

Immediate steps:
- Identify all Windows systems in your fleet and map them to the CVE-2026-20810 advisory in Microsoft’s guide.
- Deploy the update to a pilot ring within 24–48 hours, prioritizing domain controllers, administrative workstations, jump boxes, and any internet-facing servers.
- Validate that the afd.sys version matches the patched revision stated in the KB article.
- Roll out broadly after a successful pilot.

Until patches are applied, restrict local administrator rights, limit interactive logons to essential personnel, and enforce application allow-listing on sensitive hosts. These measures reduce the attack surface even if an unpatched vulnerability persists.

Why AFD Keeps Making Headlines

The Ancillary Function Driver has a long history of security issues. From 2023 to 2025, researchers and attackers alike found numerous elevation-of-privilege bugs in its code. In early 2025, for instance, a race condition in AFD was used in tandem with a browser exploit to compromise isolated corporate networks. The pattern is consistent: a user-mode process sends unexpected data to the driver, the driver mishandles it, and SYSTEM access follows.

Why does afd.sys attract so much attention? It sits at a critical boundary: every call to create a socket or configure network options passes through this kernel driver. The surface is large, the code handles complex state, and the payoff—complete control—makes it a high-value target for both red teams and real adversaries. Microsoft has hardened the driver over the years, but each new Windows build introduces changes that can inadvertently reintroduce problems.

CVE-2026-20810 is the latest in this lineage. The “free of memory not on the heap” description hints at a classic memory lifecycle bug. It could be a double-free, a use-after-free, or an attempt to release stack-allocated memory. Without a detailed technical write-up, the precise mechanism remains opaque—Microsoft intentionally limits details to slow down exploit authors. But defenders don’t need the internals to act; the presence of a patch and a critical severity rating are enough.

How to Patch and Protect Your Systems

Patching Workflow for Organizations

  1. Inventory all Windows endpoints. Use Configuration Manager, Intune, or a third-party tool to list every machine running a vulnerable Windows build. The advisory will list affected versions and their corresponding updates.
  2. Pilot the patch. Deploy to a representative sample that includes at least one domain controller, a file server, and a few admin consoles. Monitor for compatibility issues, unexpected reboots, or network hiccups.
  3. Validate the fix. After installation, check the file version of afd.sys. You can find this in the KB article or by comparing the driver’s properties in %SystemRoot%\System32\drivers with the patched version.
  4. Expand deployment. Roll the update out to the rest of the fleet in phases, prioritizing critical systems first.
  5. Implement compensating controls if you must delay. Remove local admin rights wherever possible. Block RDP access from untrusted networks. Enable Credential Guard and exploit protection features. Tighten EDR monitoring rules to flag sudden privilege elevations.

Detection Ideas

Even after patching, it’s wise to monitor for signs of exploitation during the lag period when some machines remain vulnerable. Focus on:

  • Processes spawning with SYSTEM integrity level while their parent is a standard user process.
  • Unusual spikes in Winsock-related activity: a single process repeatedly calling DeviceIoControl or opening many sockets in a short time window.
  • Kernel crashes (blue screens) that coincide with afd.sys being referenced in the dump.
  • Token manipulation events, especially those that grant high privileges to unexpected processes.

Feed these indicators into your SIEM and create automated alerts for your SOC.

Outlook: The Patch Treadmill and What Comes Next

This patch will extinguish one vector, but the underlying reality endures: kernel drivers like afd.sys remain fruitful attack surfaces. Microsoft’s shift toward virtualization-based security and hardware-enforced stack protection helps, but legacy code persists. Expect more CVEs touching the Winsock stack, and budget for the fact that local privilege escalation will remain a go-to move for attackers.

The best posture is a layered one: rapid patching, least-privilege enforcement, robust logging, and continuous threat hunting. For CVE-2026-20810, the fix is available. The only wrong move is to ignore it.