CVE-2026-68820 · Windows AFD for WinSock elevation of privilege

A use-after-free in the Windows Ancillary Function Driver for WinSock can let a locally authenticated attacker win a race condition and gain SYSTEM privileges without user interaction.

What changed

Microsoft rates the issue Important with CVSS 7.0 and marks exploitation as detected across supported Windows client and server releases.

Technical details

Install the applicable August 2026 or later cumulative update for the affected Windows release.
Examples include KB5121003 for Windows 11 24H2 and 25H2, KB5121000 for 26H1, KB5120240 for 23H2, KB5120233 for Server 2025 and KB5120242 for Server 2022.

Why it matters

Although the attack complexity is high, MSRC confirms exploitation. Supported Windows 10, Windows 11 and Windows Server systems require the applicable August or later cumulative update.

Known limitations

MSRC: Exploited Yes, Publicly Disclosed No.
Successful exploitation can yield SYSTEM privileges.

Now check

Confirm affected Windows and Windows Server versions
Deploy the applicable cumulative update
Verify fixed builds and investigate unusual local privilege-escalation activity