CVE-2026-61348

The CVSS 7 rating for this AFD.sys kernel-mode use-after-free deserves immediate skepticism. Microsoft rates 'attack complexity' as High for this class, but the historical record shows that kernel UAFs in this driver achieve reliable exploitation far faster than the scoring implies—CVE-2022-34747 and its cluster demonstrated full chains within weeks of disclosure, contradicting the complexity designation. The weaponization timeline has compressed dramatically as kernel pool grooming and heap spraying techniques matured into documented toolchains; an attacker with low-privilege local code execution in 2026 can reach SYSTEM through techniques that were academic research five years ago. The 'authorized attacker' qualifier in the CVE is an artifact that has progressively contracted across Microsoft kernel CVEs—from 'local administrator' to 'low-privilege user' to 'any local code execution.' In practice, this gap now measures in CVE disclosures, not in meaningful barriers. If your environment allows phishing lures or accepts leaked credentials, the attacker already has the prerequisite. AFD.sys occupies a structural position that makes correctness cognitively impossible at feature-development speed. The driver translates Winsock user-mode API ergonomics into kernel-mode memory operations where a single dangling pointer means system compromise. But the deeper concern is that each AFD.sys patch creates new sediment—partial hardening that pushes researchers toward different edges of the same sprawling state machine. The vulnerability frequency spikes and troughs not because the driver is becoming more secure, but because research attention follows new socket API edges and Windows networking features. What should drive your priority: determine whether this was found proactively (bounty, internal testing) or reactively patched after in-the-wild detection. That context reshapes deployment urgency. Regardless, treat CVSS 7 as a minimum floor, not a ceiling—deploy within your standard patching cadence but flag this driver for heightened monitoring. If you operate Windows containers or Azure VMs with shared-namespace configurations, the blast radius extends beyond what CVSS measures: one AFD.sys UAF can compromise tenant isolation boundaries that the base score has no vocabulary to describe.

Reviewed through automated stages and approved by a human before publication.