Use-after-free in the Windows WinSock ancillary function driver (CVE-2026-68820) — local privilege escalation
The Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CISA added it to KEV on August 11, 2026 with a due date of August 25.
Key facts
- CVE IDCVE-2026-68820
- Affected (vendor / product)Microsoft Windows Ancillary Function Driver for WinSock
- CWECWE-416
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-25 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Affected: the Windows Ancillary Function Driver for WinSock, a kernel-side driver beneath WinSock.
- The flaw is a use-after-free, CWE-416.
- An authorized attacker can elevate privileges locally — this is not a route in from outside.
- Added to KEV 2026-08-11 with a due date of 2026-08-25 (fourteen days); other entries added the same day carry three-day deadlines.
- This class of flaw is used at the stage where an intruder rises to administrator.
- A flaw in a kernel component crosses the user privilege boundary to the whole OS, unlike one in an application.
1Where the WinSock ancillary driver sits
Applications that use the network on Windows do so through WinSock (Windows Sockets). Underneath it sits the Ancillary Function Driver (AFD), which runs on the kernel side. A defect in a component running in the kernel — the core of the operating system — can cross the boundary of a user's privileges and affect the whole system, which gives it a different meaning from an application defect of nominally similar severity.
2What use-after-free means
Programs release memory they have finished with so it can be used for something else. Use-after-free is the flaw of continuing to use a region after it has been released. Because the released region may be handed to other data, an attacker who can place content there may be able to take over the program's behavior. In the kernel, that leads to system privileges.
3The conditions: local, and an authorized attacker
CISA describes the attacker as authorized and the escalation as local. This is not a flaw that lets someone in from outside. In practice, though, the standard pattern is to obtain ordinary user privileges by some other means — phishing, or another vulnerability — and then use a defect of this kind to rise to administrator.
The fourteen-day deadline, longer than the three days set for other entries added the same day, can be read as reflecting that difference in conditions.
4What a flaw in the kernel means
The same use-after-free reaches differently depending on whether it occurs in an application or in a driver running in the core of the OS.
What underpins applications using WinSock for network communication is the Ancillary Function Driver, which runs on the kernel side. Because the attacker must be authorised and escalate locally, this is not the kind of flaw that lets anyone in from outside. In practice, though, taking an ordinary user's privilege by other means and then rising to administrator through this kind of flaw is the standard combination.
Why it matters
Privilege-escalation flaws are easily deprioritized because nothing reaches them directly from outside, yet they are central to assume-breach defense — how far an intrusion spreads once it starts. Measuring patch coverage across endpoints and monitoring the use of administrative privileges are what determine the practical outcome.
FAQ
What is use-after-free?
Is a local-only flaw less urgent?
Why does a kernel driver matter?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).