CVE-2026-68820 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker with low privileges could run a specially crafted application and trigger a race condition. Successful exploitation could elevate the attacker to SYSTEM privileges. The vulnerability requires no user interaction, although exploitation has high attack complexity.

CVSS Score: 7.

SEVERITY: Important.

THREAT:
The primary threat is local privilege escalation. An attacker who already has low-privileged access could exploit the vulnerability to gain SYSTEM privileges, potentially obtaining extensive control over the affected Windows system. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITS:
Exploitation has been detected, making this an actively exploited vulnerability. It was not publicly disclosed at the time of the exploitability assessment. Exploit code maturity is listed as Unproven, so public proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker can run a specially crafted application to trigger a race condition. Exploitation requires the attacker to successfully win that race condition, which contributes to the High attack complexity rating. If successful, the attacker can elevate privileges to SYSTEM. The vulnerability has a local attack vector, requires Low privileges, and does not require user interaction.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and applicable x86, x64 and ARM64 editions. A low-privileged local attacker can exploit the flaw by running a specially crafted application and successfully triggering the race condition.

BUSINESS IMPACT:
Successful exploitation can transform limited local access into SYSTEM-level privileges. This could give an attacker powerful control over a compromised Windows endpoint or server and expose the confidentiality, integrity, and availability of information and services on that system. Because exploitation has already been detected, organizations running affected Windows systems face an immediate privilege-escalation risk.

WORKAROUND:
No mitigations or workarounds are identified. An official fix is available, so affected systems should be updated through the applicable Windows security update.

URGENCY:
Exploitation has been detected in the wild, so deployment should be prioritized even though the vulnerability is rated Important rather than Critical. Successful exploitation can grant SYSTEM privileges, and there is no documented workaround or mitigation when the patch cannot be applied.