Vulnerabilities
CVE-2026-70205: Windows Ancillary Function Driver for WinSock Local Privilege Escalation via Type Confusion
A local privilege escalation flaw (CVE‑2026‑70205) in Windows Ancillary Function Driver for WinSock allows an authorized user to gain elevated rights through a type‑confusion bug. The vulnerability is exploitable on systems running affected Windows versions until the latest security update. Defenders should apply the MSRC patch immediately and verify driver integrity.
What happened
A type‑confusion bug in the Windows Ancillary Function Driver for WinSock (AFD) permits an authorized user to access a resource with an incompatible type, enabling local privilege escalation.
Impact
Any user with local access to a vulnerable system can elevate privileges to SYSTEM, potentially compromising the entire machine. The flaw exists in all Windows versions that include the affected AFD driver until the latest cumulative update.
Mitigation
- Install the latest cumulative security update from Microsoft (MSRC‑2026‑70205).
- Verify that the AFD driver version matches the patched release.
- Apply the patch to all endpoints in the environment.
Monitoring and Detection
Watch for anomalous privilege‑escalation activity, such as unexpected SYSTEM‑level processes spawned by non‑SYSTEM users. Enable audit logs for process creation and driver loading.
Related vulnerabilities
CVE-2026-70168: Windows Ancillary Function Driver for WinSock Local Privilege Escalation
A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock (CVE‑2026‑70168) lets a local user with sufficient privileges gain SYSTEM rights. The issue is limited to systems where the driver is loaded and can be mitigated by applying the latest Windows update or disabling the driver if not needed.
Read briefing
CVE-2026-83738: Windows Ancillary Function Driver for WinSock Privilege Escalation via Use-After-Free
A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock allows a local user with sufficient privileges to gain elevated rights. Microsoft has released an update that patches the driver. Defenders should apply the latest Windows updates and monitor for anomalous privilege escalation attempts.
Read briefing
CVE-2026-83694: Windows Volume Manager Extension Driver Local Privilege Escalation
Microsoft has disclosed a local privilege escalation vulnerability in the Windows Volume Manager Extension Driver (CVE‑2026‑83694). An authenticated attacker can trigger an out‑of‑bounds read, allowing elevation of privileges on the affected system. Defenders should apply the latest security updates and verify driver integrity.
Read briefing
CVE-2026-83827: Windows Bluetooth Port Driver Local Privilege Escalation
A heap‑based buffer overflow in the Windows Bluetooth Port Driver (CVE‑2026‑83827) lets a local attacker gain elevated privileges. The flaw affects all Windows systems with the Bluetooth driver enabled. Defenders should apply the latest Microsoft patch, disable Bluetooth when not needed, and monitor for suspicious local activity.
Read briefing