CVE-2026-68820

What is the Ancillary Function Driver for WinSock?

afd.sys — the Ancillary Function Driver for WinSock — is the kernel-mode driver underpinning the Windows Sockets API. Every TCP/IP socket operation on Windows passes through it.

That makes it an unusually durable attack surface. It is present and reachable on every Windows installation by default, requires no special privilege to interact with, cannot be disabled or unloaded, and is callable from inside AppContainer and low-integrity sandboxes. Those properties have made it a perennial favourite for local privilege escalation and sandbox escape: this is the same driver behind CVE-2023-21768 and CVE-2024-38193, the latter also used by Lazarus for exactly the purpose seen here.

Overview

CVE-2026-68820 is a use-after-free in afd.sys that a locally authenticated attacker can exploit to escalate to SYSTEM. Despite living in a networking driver, it is not remotely exploitable — the attack surface is the local IOCTL interface, not the network. The attacker must already have code execution on the host.

It was patched in the August 2026 Patch Tuesday (2026-08-11), where it was the release's headline actively exploited zero-day. Two other zero-days in the same release — CVE-2026-62832 (Windows User Profile Service EoP) and CVE-2026-72971 (Windows Container Isolation driver tampering) — were publicly disclosed but not exploited.

Check Point Research attributes exploitation to the North Korea-linked Lazarus Group, using it to install a new version of the FudModule kernel rootkit.

Affected Versions

Fixed by: the August 2026 cumulative and monthly rollup updates released 2026-08-11. Windows 10 1607, Server 2012, and Server 2012 R2 receive the fix through the ESU channel — confirm ESU coverage for those estates. Consult the MSRC advisory for the specific KB number matching each build.

Technical Details

The vulnerability is a use-after-free (CWE-416) caused by improper synchronization when multiple threads concurrently manipulate socket-related state. Under specific timing, one code path frees a memory object while another continues to hold and dereference a stale pointer to it.

Exploitation is therefore a race condition. The attacker's application repeatedly triggers the racing operations until it wins the free/use window, then grooms the kernel pool so that the freed allocation is reclaimed by attacker-controlled data. Manipulating the resulting corrupted kernel structures yields an arbitrary kernel read/write primitive, which is escalated to SYSTEM.

Attack characteristics:

• Authentication required: yes — a locally authenticated attacker running a crafted application.
• User interaction: none.
• Attack complexity: high. Winning the race is probabilistic, which is what holds the CVSS to 7.0 despite a SYSTEM-level outcome.
• Chaining: inherent. This is an escalation link — it follows an initial-access stage and precedes rootkit installation.

The specific afd.sys function or IOCTL involved has not been publicly disclosed.

Discovery

Reported to Microsoft by Moshe Marelus and David Driker of Check Point Research, who found it while investigating active Lazarus intrusions rather than through fuzzing or code review.

One secondary source (SOC Prime) gives the disclosure milestones as reported to MSRC on 2026-07-28, confirmed by Microsoft on 2026-07-31, CVE assigned 2026-08-05, and patched 2026-08-11. These dates are not vendor-confirmed and rest on that single source.

Exploitation Context

• Confirmed zero-day, exploited before a patch existed. Microsoft marked it Exploitation Detected at release.
• Threat actor: the North Korea-linked Lazarus Group, per Check Point Research, operating within the long-running Operation Dream Job campaign — fake recruiter lures aimed at employees of high-value firms.
• Targeted sectors: defense, aerospace, aviation, and robotics.
• Purpose of the exploit: to install a new version of FudModule, Lazarus's kernel-mode rootkit. FudModule requires a kernel read/write primitive, which this use-after-free supplies; it is used to blind EDR by tampering with kernel callbacks and object attributes. Lazarus used the earlier afd.sys bug CVE-2024-38193 for precisely the same purpose, making this a repeat of an established tradecraft pattern rather than a novel one.
• Exploitation reportedly began in early July 2026, roughly a month before the patch — again per SOC Prime, and not vendor-confirmed.
• Exposure counts do not apply — this is a local vulnerability, not an internet-exposed service.
• No public proof-of-concept was available at the time of writing.

Remediation

1. Apply the August 2026 (2026-08-11) Windows cumulative update for the relevant OS build. There is no workaround or configuration mitigation — afd.sys cannot be disabled or unloaded.
2. Prioritize hosts matching the targeting. Defense, aerospace, aviation, and robotics organizations should patch engineering and HR workstations first, since Operation Dream Job lures are recruiter-themed and land on the people who read unsolicited CVs and job offers.
3. Confirm ESU coverage for Windows Server 2012 / 2012 R2 and Windows 10 1607 estates, which require the extended-support channel to receive this fix.
4. Treat suspected exploitation as post-compromise. Because this is an escalation link rather than an entry point, patching does not resolve an intrusion that already used it. Hunt both the preceding initial-access stage and the subsequent rootkit.
5. Hunt for exploitation. Microsoft has published no CVE-specific IoCs, so detection is behavioural:
   • Anomalous handle and IOCTL activity against \Device\Afd from unusual processes, particularly high-rate repeated calls consistent with hammering a race condition.
   • Unexpected privilege transitions to SYSTEM from non-service, user-launched processes.
   • Kernel driver load anomalies and DKOM-style tampering with kernel callbacks — the FudModule signature behaviour.
   • EDR sensor blinding — callbacks removed, telemetry gaps, or a sensor going quiet with no corresponding uninstall event.
   • Operation Dream Job initial-access artifacts — DLL sideloading, malicious PDF delivery chains, and recruiter-themed archives or documents.
   • Consult Check Point Research's publication for campaign-level IoCs such as hashes and C2 infrastructure.