A critical time-of-check time-of-use vulnerability in the Windows Ancillary Function Driver for WinSock allows local authenticated attackers to escalate privileges to system level.

This is a time-of-check time-of-use (TOCTOU) race condition within the Ancillary Function Driver for WinSock, which requires the attacker to have valid local user credentials to initiate the exploit.

Successful exploitation grants an attacker local privilege escalation, effectively bypassing standard security boundaries to gain administrative control over the affected system. With a CVSS score of 7.8, this vulnerability represents a significant risk to organizational integrity, as it allows compromised low-level accounts to gain full system access, potentially facilitating lateral movement and data exfiltration.

Immediate Action: Apply the relevant monthly security updates provided by Microsoft in the January 2026 release cycle to address the vulnerability in the Ancillary Function Driver for WinSock.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected administrative activities originating from standard user accounts.

Compensating Controls: Ensure that endpoint detection and response (EDR) solutions are active to detect and block unauthorized privilege escalation attempts.

Public Exploit Available: No.

Given the potential for complete system compromise, organizations should prioritize the deployment of the January 2026 security updates across all affected Windows workstations and servers. Immediate patching is the most effective way to eliminate this risk, as local privilege escalation vulnerabilities are frequently leveraged by threat actors to expand their control within a network.