CVE-2026-21236 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-21236

CVE-2026-21236 describes a heap-based buffer overflow in the Windows Ancillary Function Driver for WinSock (AFD) that enables an authenticated local attacker to obtain elevated privileges. The vulnerability is categorized as a local, privilege-escalation issue, with the affected component being t...

CVE-2026-21236

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

PT-2026-7345

Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A use-after-free condition exists in the Windows Ancillary Function Driver for WinSock, specifically within the afd.sys file. This issue allows an authorized attacker to elevate...

PT-2026-7342

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-21241: Use After Free

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-21238: Improper Access Control

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-21236: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

VFIO Heap Buffer Overflow DoS

The vulnerability of the vfioiommuiovabuildcaps function in the drivers/vfio/vfioiommutype1.c file of the VFIO device driver in the Linux operating system involves the disclosure of confidential information. Exploiting this vulnerability could allow an attacker to cause a service failure...

Microsoft Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Microsoft Windows Ancillary Function Driver for WinSock is an ancillary function driver for Winsock from Microsoft USA. An elevation of privilege vulnerability exists in the Microsoft Windows Ancillary Function Driver for WinSock due to a type obfuscation flaw in the auxiliary function driver for...

net: hns3: using the num_tqps in the vf driver to apply for resources

...

Windows Ancillary Function Driver WinSock Privilege Escalation

The vulnerability of the Windows Ancillary Function Driver for WinSock operating systems is related to data type mixing errors. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-20860

Access of resource using incompatible type 'type confusion' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-20860

Access of resource using incompatible type 'type confusion' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-20860

Access of resource using incompatible type 'type confusion' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-20860 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

...

CVE-2026-20860

CVE-2026-20860 affects the Windows Ancillary Function Driver for WinSock and is a local privilege escalation via type confusion. Connected documents confirm the affected component and that exploitation requires local access with privileges already. Public details on exploit methods are not provid...