CVE-2024-38193: Windows AFD.sys use-after-free local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a KEV-listed, publicly exploited local privilege-escalation flaw with high EPSS, but it requires an existing low-privileged foothold rather than being remotely exploitable.

What it is

The Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free (CWE-416) that lets a local user elevate privileges to SYSTEM. It affects a broad set of Windows 10, Windows 11 and Windows Server releases, and Microsoft patched it in the August 2024 update. Because it is a kernel driver flaw reachable by any logged-on user, it is a standard building block for post-compromise escalation.

Impact

An attacker who already has code execution as a low-privileged user can gain full SYSTEM privileges on the host, enabling credential theft, disabling of security controls and lateral movement.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the flaw is reached by a logged-on user running a crafted program that triggers the driver's use-after-free. No remote or network path is described.

Exploitation

CVE-2024-38193 is listed in CISA KEV (added 2024-08-13, remediation due 2024-09-03) and has a public Exploit-DB entry, indicating known exploitation in the wild; EPSS is 0.285 (98th percentile). CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft August 2024 security update for the affected Windows versions as the primary fix.
• If patching cannot be completed by the KEV due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.
• Restrict local interactive and service logon rights to only accounts that need them, reducing the pool of users who can trigger the flaw.
• Harden against the prerequisite foothold: block untrusted executables and macros, and monitor for initial-access activity that precedes local escalation.

Detection

• Alert on unexpected processes spawning from low-privileged user contexts that quickly obtain SYSTEM tokens or load afd.sys-related handles.
• Monitor for known public exploit artifacts and unusual child processes of user applications on patched and unpatched hosts.
• Track Windows event logs for privilege-escalation indicators such as token manipulation, new SYSTEM-level services, or suspicious driver interaction.
• Verify patch state across the listed Windows 10, 11 and Server builds and flag unpatched endpoints for priority remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.