CVE-2026-33099: 
vulnerability analysis and mitigation

CVE-2026-33099 is a use-after-free (UAF) vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that allows an authorized local attacker with low privileges to elevate their privileges on affected systems. Disclosed on April 14, 2026, as part of Microsoft's April 2026 Patch Tuesday, it affects a broad range of Windows versions including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2012, 2012 R2, 2016, 2019, and 2022. It carries a CVSS v3.1 base score of 7.0 (High) (Microsoft MSRC, GitHub Advisory).

The vulnerability is classified as CWE-416 (Use After Free), meaning the Windows Ancillary Function Driver for WinSock (afd.sys) references memory after it has been freed, potentially allowing an attacker to manipulate that memory region to redirect execution flow. Exploitation requires local access and low-level privileges (e.g., a standard user account), but no user interaction is needed. The attack complexity is rated High, indicating that specific conditions or race conditions must be met for successful exploitation. No public technical write-ups or proof-of-concept code have been identified at this time (Microsoft MSRC, GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to execute arbitrary code with elevated (SYSTEM-level) privileges, resulting in complete compromise of the affected host — including full confidentiality, integrity, and availability impact. An attacker who gains SYSTEM privileges can access all data on the system, install malware, create backdoor accounts, disable security controls, and potentially use the compromised host as a pivot point for lateral movement within a network. The vulnerability affects a wide range of Windows desktop and server platforms, increasing the potential blast radius in enterprise environments (Microsoft MSRC).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.04–0.052%, placing it in the 17th percentile for exploitation likelihood within 30 days. No threat actor attribution has been made, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The High attack complexity rating further reduces near-term weaponization risk (GitHub Advisory, Microsoft MSRC).

Microsoft released patches on April 14, 2026, as part of the April 2026 Patch Tuesday update cycle. Patched build versions include: Windows 10 21H2/22H2 (10.0.19044.7184 / 10.0.19045.7184), Windows 11 23H2 (10.0.22631.6936), Windows 11 24H2 (10.0.26100.8246), Windows 11 25H2 (10.0.26200.8246), Windows Server 2016 (10.0.14393.9060), Windows Server 2019 (10.0.17763.8644), Windows Server 2022 (10.0.20348.5020), Windows Server 2022 23H2 (10.0.25398.2274), and Windows Server 2012 R2 (6.3.9600.23132). As an interim measure, organizations should restrict local logon access to trusted users only, implement Privileged Access Management (PAM) solutions, and monitor for suspicious processes running with elevated privileges (Microsoft MSRC).

The vulnerability was covered as part of broader April 2026 Patch Tuesday reporting. BleepingComputer noted it among 167 flaws fixed in the April 2026 update, and the Zero Day Initiative (ZDI) included it in their monthly security update review. Rapid7 also covered it in their Patch Tuesday analysis. No specific researcher commentary or notable social media discussion focused exclusively on this CVE has been identified (BleepingComputer, ZDI Blog, Rapid7 Blog).