Vulnerabilities
CVE-2026-70168: Windows Ancillary Function Driver for WinSock Local Privilege Escalation
A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock (CVE‑2026‑70168) lets a local user with sufficient privileges gain SYSTEM rights. The issue is limited to systems where the driver is loaded and can be mitigated by applying the latest Windows update or disabling the driver if not needed.
What happened
A use‑after‑free bug in the Windows Ancillary Function Driver for WinSock allows a local user with sufficient privileges to trigger a memory corruption that can be leveraged to execute code with SYSTEM rights.
Impact
Systems that have the driver loaded are vulnerable. An attacker who can run code locally (e.g., through a compromised account or malicious software) can elevate to SYSTEM, enabling full control over the machine.
Mitigation
- Apply the latest cumulative update that addresses CVE‑2026‑70168.
- If the driver is not required for your environment, consider disabling or removing it via Group Policy or registry.
- Limit local user privileges to the least necessary level.
Detection
Watch for abnormal memory allocation patterns or unexpected SYSTEM‑level processes spawned by user‑initiated applications. Enable Windows Defender Advanced Threat Protection or similar to detect exploitation attempts.
Related vulnerabilities
CVE-2026-83738: Windows Ancillary Function Driver for WinSock Privilege Escalation via Use-After-Free
A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock allows a local user with sufficient privileges to gain elevated rights. Microsoft has released an update that patches the driver. Defenders should apply the latest Windows updates and monitor for anomalous privilege escalation attempts.
Read briefing
CVE-2026-70205: Windows Ancillary Function Driver for WinSock Local Privilege Escalation via Type Confusion
A local privilege escalation flaw (CVE‑2026‑70205) in Windows Ancillary Function Driver for WinSock allows an authorized user to gain elevated rights through a type‑confusion bug. The vulnerability is exploitable on systems running affected Windows versions until the latest security update. Defenders should apply the MSRC patch immediately and verify driver integrity.
Read briefing
CVE-2026-83827: Windows Bluetooth Port Driver Local Privilege Escalation
A heap‑based buffer overflow in the Windows Bluetooth Port Driver (CVE‑2026‑83827) lets a local attacker gain elevated privileges. The flaw affects all Windows systems with the Bluetooth driver enabled. Defenders should apply the latest Microsoft patch, disable Bluetooth when not needed, and monitor for suspicious local activity.
Read briefing
CVE-2026-83694: Windows Volume Manager Extension Driver Local Privilege Escalation
Microsoft has disclosed a local privilege escalation vulnerability in the Windows Volume Manager Extension Driver (CVE‑2026‑83694). An authenticated attacker can trigger an out‑of‑bounds read, allowing elevation of privileges on the affected system. Defenders should apply the latest security updates and verify driver integrity.
Read briefing