Security Bulletin: Local Privilege Escalation via Use-After-Free in Windows Ancillary Function Driver for WinSock

Written by RedLegg's Cyber Threat Intelligence Team | 8/12/26, 1:15 PM

About:

CVE-2026-68820 is a local elevation of privilege vulnerability affecting the Windows Ancillary Function Driver for WinSock (AFD.sys), the kernel-mode driver responsible for handling socket operations for Windows networking.

The vulnerability is caused by a use-after-free condition that allows a locally authenticated attacker with low privileges to trigger a race condition through a specially crafted application. Successful exploitation enables privilege escalation to SYSTEM without requiring user interaction.

Microsoft confirmed CVE-2026-68820 as a zero-day actively exploited in the wild at the time of disclosure. Exploitation requires an attacker to already have a foothold on the target system.

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

VULNERABILITIES

Local Privilege Escalation via Use-After-Free in Windows Ancillary Function Driver for WinSock

Identifier: CVE-2026-68820
PoC or Exploitation:

Confirmed actively exploited in the wild as a zero-day at time of disclosure.

CVSS Score: 7.0 base / 6.1 temporal (Important, CVSS v3.1)

Update / Patch:

Microsoft has released fixed builds addressing this vulnerability as part of the August 2026 Patch Tuesday cumulative update.

Affected versions include:

Windows 10 Version 1607: 10.0.14393.0 through before 10.0.14393.9418
Windows 10 Version 1809: 10.0.17763.0 through before 10.0.17763.9115
Windows 10 Version 21H2: 10.0.19044.0 through before 10.0.19044.7663
Windows 10 Version 22H2: 10.0.19045.0 through before 10.0.19045.7663
Windows 11 Version 23H2: 10.0.22631.0 through before 10.0.22631.7517
Windows 11 Version 24H2: 10.0.26100.0 through before 10.0.26100.9168
Windows 11 Version 25H2: 10.0.26200.0 through before 10.0.26200.9168
Windows 11 Version 26H1: 10.0.28000.0 through before 10.0.28000.2704

Windows Server 2012 and R2, including Server Core: 6.2.9200.0 / 6.3.9600.0 through before 6.2.9200.26279 / 6.3.9600.23337Windows Server 2016, including Server Core: 10.0.14393.0 through before 10.0.14393.9418Windows Server 2019, including Server Core: 10.0.17763.0 through before 10.0.17763.9115Windows Server 2022: 10.0.20348.0 through before 10.0.20348.5499Windows Server 2025, including Server Core: 10.0.26100.0 through before 10.0.26100.33296

Microsoft advisory and patch guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820

Description:

CVE-2026-68820 is a local elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), the kernel-mode driver that handles socket operations for networked Windows processes.

A locally authenticated attacker with low privileges can run a specially crafted application to trigger a race condition, without requiring user interaction, and escalate to SYSTEM privileges.

Exploitation requires an attacker to already have a foothold on the target system.

Mitigation Recommendation:

Apply the applicable August 2026 cumulative update for your Windows version immediately, prioritizing internet-facing and high-value endpoints.

Monitor for anomalous SYSTEM-level activity following low-privileged process execution.

View full post