Vulnerabilities
CVE-2026-83738: Windows Ancillary Function Driver for WinSock Privilege Escalation via Use-After-Free
A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock allows a local user with sufficient privileges to gain elevated rights. Microsoft has released an update that patches the driver. Defenders should apply the latest Windows updates and monitor for anomalous privilege escalation attempts.
What happened
A use‑after‑free bug in the Windows Ancillary Function Driver for WinSock can be triggered by an authorized local user to gain higher privileges.
Impact
Exploiting the flaw permits privilege escalation on the affected system, potentially enabling the attacker to install software, modify system settings, or compromise other accounts.
Mitigation
Apply the latest Windows security update that addresses CVE‑2026‑83738. Verify that the Ancillary Function Driver is at the patched version and disable any unnecessary WinSock services if feasible.
Detection
Monitor for unexpected changes in user account privileges, anomalous driver activity, or repeated attempts to access privileged APIs from non‑elevated processes.
Related vulnerabilities
CVE-2026-70168: Windows Ancillary Function Driver for WinSock Local Privilege Escalation
A use‑after‑free flaw in the Windows Ancillary Function Driver for WinSock (CVE‑2026‑70168) lets a local user with sufficient privileges gain SYSTEM rights. The issue is limited to systems where the driver is loaded and can be mitigated by applying the latest Windows update or disabling the driver if not needed.
Read briefing
CVE-2026-70205: Windows Ancillary Function Driver for WinSock Local Privilege Escalation via Type Confusion
A local privilege escalation flaw (CVE‑2026‑70205) in Windows Ancillary Function Driver for WinSock allows an authorized user to gain elevated rights through a type‑confusion bug. The vulnerability is exploitable on systems running affected Windows versions until the latest security update. Defenders should apply the MSRC patch immediately and verify driver integrity.
Read briefing
CVE-2026-70274: Windows Bind Filter Driver Local Privilege Escalation
A use‑after‑free flaw in the Windows Bind Filter Driver allows an authenticated local user to elevate privileges. Microsoft has released a patch; defenders should apply it immediately and verify driver integrity.
Read briefing
CVE-2026-70252: Local Privilege Escalation via VHD Miniport Driver Use-After-Free
A use‑after‑free flaw in the Windows Virtual Hard Disk (VHD) mini‑port driver allows any local user to gain System privileges by mounting a crafted VHD file. The vulnerability is limited to machines running the affected driver version and can be mitigated by applying Microsoft’s latest cumulative update. Defenders should patch immediately and monitor for privilege‑escalation events.
Read briefing