CVE-2025-21418: Windows Ancillary Function Driver for WinSock heap overflow privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable privilege escalation flaw with confirmed in-the-wild exploitation per CISA KEV, though it requires local access and low privileges rather than being remotely reachable.

What it is

The Windows Ancillary Function Driver for WinSock (afd.sys) contains a heap-based buffer overflow that allows a local user to elevate privileges. Microsoft rates it 7.8 HIGH, and CISA added it to the Known Exploited Vulnerabilities catalog on the publication date, so it is being used in the wild.

Impact

A local attacker who triggers the overflow can execute code with higher privileges, up to SYSTEM, giving full control of the affected host.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so any logged-on user who can reach the WinSock driver interface can attempt it. No remote or network path is described in the record.

Exploitation

CISA added it to KEV on 2025-02-11 with a remediation due date of 2025-03-04, confirming known exploitation; EPSS is 0.01568 (74th percentile), which is modest but consistent with a locally exploited, targeted flaw. No ransomware campaign use is documented.

What to do

• Apply the Microsoft February 2025 security update for all listed Windows client and server versions immediately, prioritizing internet-facing and multi-user systems.
• Restrict interactive logon and local privilege assignment to only users who need it, reducing the pool of accounts that can reach the driver.
• Enable and monitor Windows Defender and EDR detections for local privilege escalation behavior on afd.sys.
• If patching cannot be completed by the KEV due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.

Detection

• Alert on unexpected processes loading or interacting with afd.sys outside normal WinSock activity.
• Monitor for processes that spawn with SYSTEM integrity from a non-system parent, especially shortly after a user logon.
• Correlate local privilege escalation telemetry with known post-exploitation tooling behavior on endpoints.
• Track patch state of the listed Windows builds against the KEV due date of 2025-03-04.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.