Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Successful exploitation allows a local authorized attacker with low privileges to elevate to SYSTEM. With SYSTEM-level execution, an attacker can fully compromise the affected host, including accessing sensitive data, modifying system state, installing or executing arbitrary payloads with maximum local privileges, disabling security controls, and causing service or system disruption. The provided CVSS 3.1 vector indicates high confidentiality, integrity, and availability impact.

No specific workaround or mitigation is provided in the supplied content beyond applying the official fix. Because exploitation is local and requires low privileges plus successful race-condition timing, practical risk reduction measures include minimizing local interactive access, restricting execution by untrusted users, enforcing least privilege, and monitoring for suspicious local privilege-escalation activity until patches are fully deployed.

Apply Microsoft's official security update for CVE-2026-27922. The provided content states that an official fix was available at publication. Standard remediation should include deploying the relevant April 2026 Windows security updates to affected systems and validating successful installation across the fleet.