Brief Summary: CVE-2026-34344 — Windows AFD Type Confusion Enables Local Privilege Escalation to SYSTEM

Introduction

A type confusion bug in one of the most fundamental kernel drivers in the Windows networking stack gives any locally authenticated user a clean path to SYSTEM privileges. CVE-2026-34344 targets afd.sys, the Ancillary Function Driver for WinSock, which underpins virtually every socket operation on a Windows host. Exploitation has low attack complexity and needs no user interaction.

Windows held roughly 72.3 percent of the desktop operating system market as of late 2025, and afd.sys is present on every supported Windows installation. That makes the blast radius substantial, even though exploitation requires local access. Microsoft fixed the flaw in the May 2026 Patch Tuesday release, alongside 119 other fixes.

Technical Information

Root Cause: CWE-843 Type Confusion in afd.sys

The core issue is a type confusion vulnerability (CWE-843) in the Windows Ancillary Function Driver for WinSock. In practical terms, the kernel driver was casting or interpreting an internal data structure as the wrong type. When a low-privileged user triggers this code path, the driver operates on a resource as though it were a different type than it actually is, which corrupts kernel memory.

The corruption can do more than crash the process. Because afd.sys runs in kernel mode (Ring 0), it gives an attacker a primitive to overwrite kernel structures and escalate privileges to SYSTEM.

CVSS 3.1 Breakdown

Microsoft assigned a CVSS 3.1 base score of 7.8 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Each metric describes part of the exploitation profile:

• Attack Vector (Local): The attacker must already have local access to the target system. This vulnerability alone does not allow remote exploitation.
• Attack Complexity (Low): The attack needs no race conditions, specialized configurations, or other prerequisites beyond the attacker's control.
• Privileges Required (Low): A standard, unprivileged user account is enough to trigger the bug. No administrative or elevated privileges are needed.
• User Interaction (None): The exploit can run on its own, without another user clicking, opening, or interacting with anything.
• Scope (Unchanged): The impact stays within the security authority of the vulnerable component, though in this case that component is the kernel itself.
• Confidentiality, Integrity, Availability (all High): Successful exploitation yields SYSTEM privileges, so the attacker can read all data, modify any file or configuration, and fully disrupt system availability.

Attack Flow

Based on the available information, exploitation would follow this general sequence:

1. An attacker obtains local access to a Windows system with a standard (low privilege) user account. This could come from legitimate credentials, a compromised user session, or a prior initial access vector.
2. The attacker invokes a crafted operation against afd.sys that triggers the type confusion. Because the driver handles socket operations, this likely involves specific I/O control requests (IOCTLs) or socket API calls that make the driver misinterpret an internal data structure.
3. The type confusion corrupts kernel memory in a controlled way, so the attacker can overwrite critical kernel structures (such as token objects or process structures).
4. The attacker uses the corrupted state to elevate their process token to SYSTEM and takes full administrative control of the host.

The low complexity rating suggests the confusion path is relatively straightforward to trigger once the correct input is identified.

Discovery

Security researchers Puponia and Angelboy, both associated with DEVCORE, discovered and reported the vulnerability. DEVCORE has a well-established track record of finding high-impact vulnerabilities in widely deployed software, which makes it more likely that detailed technical writeups or proof-of-concept code will surface in the coming weeks or months.

Patch Information

Microsoft released the official fix for CVE-2026-34344 on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. Because afd.sys is a closed-source Windows kernel driver, Microsoft has not published a source-level diff. The fix ships only through cumulative updates on Windows Update and the Microsoft Update Catalog.

The patch corrects the type-handling logic so the driver validates the type of a resource before operating on it, which removes the confusion path. Microsoft's CVSS temporal vector includes RL:O (Official Fix), which confirms the remediation is complete.

The update covers a broad matrix of affected products. Every supported Windows desktop and server edition received a corresponding KB article:

For newer server and desktop editions (Server 2025, Server 2022, Windows 11 24H2/25H2), Microsoft offered both a standard cumulative security update and a separate Security Hotpatch update (e.g., KB5087423, KB5087424, KB5089466). Hotpatching applies in-memory patches to a running kernel without a reboot, which is particularly valuable for production servers where downtime must be kept to a minimum.

To apply the fix, administrators should install the applicable cumulative update through Windows Update or WSUS, or download the package directly from the Microsoft Update Catalog. The vulnerable driver runs at kernel level, and the exploit yields SYSTEM privileges with low attack complexity and no user interaction, so prompt patching is strongly recommended. Prioritize systems that allow standard user access or host multiple users, because they carry the highest risk of local privilege escalation.

Microsoft has not published any workarounds or alternative mitigations for this vulnerability, so the cumulative update is the only remediation path.

Affected Systems and Versions

Based on the patch matrix Microsoft published, the following Windows versions are confirmed affected:

Desktop Editions:

• Windows 11 version 26H1 (x64 and ARM64)
• Windows 11 versions 25H2 and 24H2 (x64 and ARM64)
• Windows 11 version 23H2 (x64 and ARM64)
• Windows 10 version 22H2 (all architectures)
• Windows 10 version 21H2 (all architectures)
• Windows 10 version 1809
• Windows 10 version 1607

Server Editions:

• Windows Server 2025
• Windows Server 2022 (including 23H2)
• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2
• Windows Server 2012

The vulnerable component, afd.sys, is present on all of these editions. Treat any system running a build older than the patched build numbers in the Patch Information section above as vulnerable.

Vendor Security History

The May 2026 Patch Tuesday release that included this fix addressed 120 security flaws in total, with no zero-days disclosed during the cycle. Microsoft handles vulnerability disclosures and patches through the Microsoft Security Response Center (MSRC). The AFD driver has historically been a target for privilege escalation research. As a kernel-mode component that handles user-accessible socket operations, it is a recurring area of interest for both researchers and attackers.

References

• Microsoft Security Update Guide: CVE-2026-34344
• NVD Entry: CVE-2026-34344
• Tenable: CVE-2026-34344
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Lansweeper: Microsoft Patch Tuesday May 2026
• KB5087544: Windows 10 22H2/21H2
• KB5089549: Windows 11 25H2/24H2
• KB5089548: Windows 11 26H1
• KB5087538: Windows Server 2019
• KB5087539: Windows Server 2025
• MSRC Vulnerability Coordination Process
• Operating System Market Share (September 2025)