CVE-2026-68820: Windows WinSock Driver — Use-After-Free Privilege Escalation

Background

The Windows Ancillary Function Driver (afd.sys) is a kernel-mode driver that provides the interface between user-mode socket calls and the kernel networking stack. Every application using the Winsock API — web browsers, office applications, any networked software — has kernel interactions mediated by afd.sys. Its ubiquity across all supported Windows versions makes vulnerabilities in this component exceptionally broad in scope.

CVE-2026-68820 is a use-after-free vulnerability in afd.sys. A locally authenticated attacker with low privileges can exploit a race condition in the driver to gain SYSTEM-level privileges. Microsoft patched the vulnerability as part of the August 2026 Patch Tuesday release. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 11 August 2026. Check Point Research attributed active exploitation to the Lazarus Group — North Korea’s primary threat actor cluster — as part of its Operation Dream Job campaign targeting employees in sectors including defence, aerospace, and technology.

Technical Mechanism

CWE-416 (Use After Free) is the root cause classification.

A use-after-free vulnerability occurs when a program continues to use a memory reference after the underlying memory has been freed. In the kernel context of afd.sys, a race condition allows an attacker to trigger this state: a memory object is freed during one code path while another code path retains and subsequently dereferences the same pointer.

The exploitation mechanism requires winning the race condition to control the freed memory before it is overwritten with unrelated content, then shaping the memory layout (heap spraying) to place attacker-controlled data at the freed address. When the driver dereferences the stale pointer, it accesses attacker-controlled memory, enabling control flow redirection to attacker-supplied kernel shellcode.

Microsoft’s CVSS assessment assigns Attack Complexity: High (AC:H) — reflecting the race condition requirement — and Privileges Required: Low (PR:L), meaning any standard user account is sufficient to attempt exploitation. No User Interaction is required.

The practical implication is that any malware or attacker code running with user-level privileges on a Windows system can leverage this vulnerability to achieve SYSTEM privileges, enabling disabling of security tools, credential dumping, persistence mechanisms, and full system compromise.

Real-World Exploitation Evidence

CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities catalog on 11 August 2026.

Check Point Research identified this vulnerability being exploited by Lazarus Group, the North Korean state-sponsored threat actor, in its ongoing Operation Dream Job campaign. The campaign targets professionals in defence, aerospace, cryptocurrency, and technology sectors with fake job offers delivered through LinkedIn and email. Initial access is typically achieved via social engineering that leads the victim to run a malicious payload; CVE-2026-68820 is then used as a local privilege escalation step to gain SYSTEM access after initial execution.

The vulnerability functions as a post-exploitation tool: Lazarus combines it with spear-phishing lures and initial-access payloads to move from low-privilege execution to full system control. The group has an established history of exploiting Windows kernel vulnerabilities, including prior use of Winsock-related components.

The combination of broad Windows version coverage, low privilege requirement, and an in-the-wild weaponized exploit makes this a high-priority patch for all Windows environments.

Impact Assessment

Successful exploitation elevates a low-privilege local attacker to SYSTEM — the highest privilege level on a Windows host. From SYSTEM, an attacker can disable or tamper with security tools and endpoint detection agents, dump credentials from LSASS memory for lateral movement across the network, install persistent kernel-level implants or rootkits, and stage or exfiltrate data without restriction.

In the context of the Lazarus Group’s Operation Dream Job campaign, this vulnerability is used as a privilege escalation step following initial social engineering access. The downstream effect is full host compromise that enables the group’s documented objectives: long-term persistent access, intellectual property theft, and in some cases financial fraud targeting cryptocurrency and technology sector victims.

Affected Versions

Fixes were applied via the August 2026 Patch Tuesday cumulative update, distributed through Windows Update.

Remediation Steps

1. Apply the August 2026 Patch Tuesday cumulative update via Windows Update, Windows Server Update Services, or Microsoft Update Catalog. The patch addresses the race condition in afd.sys.

2. For environments where immediate patching is not possible:

   • Prioritise systems in high-risk roles: endpoints targeted by phishing, internet-facing servers, contractor or partner machines with elevated network access
   • Monitor for and block the known Lazarus Group initial-access delivery vectors (malicious LinkedIn messages, fake job application documents)
   • Implement application allowlisting to reduce the attack surface available for initial code execution

Note that without fixing the underlying kernel vulnerability, there is no configuration-level workaround. The race condition is in core networking code that cannot be disabled without breaking Winsock functionality.

Detection Guidance

Log sources: Windows Security Event Log; kernel crash dumps; endpoint detection and response telemetry; network connection logs.

What to look for:

• Unexpected SYSTEM-level process creation from user-level parent processes, particularly document readers, browsers, or download managers
• Processes calling afd.sys IOCTLs in unusual patterns or at abnormal frequency
• Windows kernel crash events (Bug Check) preceding successful exploitation attempts — failed race condition attempts may produce crashes
• Suspicious outbound connections established by newly elevated processes
• Credential access tool signatures (Mimikatz, LSASS dumps) following anomalous privilege transitions

Lazarus-specific IOCs: Check Point Research published indicators of compromise for the Operation Dream Job campaign associated with this exploitation, including file hashes and command-and-control infrastructure. Consult threat intelligence feeds for current Lazarus infrastructure indicators. The initial delivery typically involves ISO or ZIP files containing LNK files masquerading as job application documents.

For incident responders: the presence of this vulnerability does not confirm Lazarus involvement — any local attacker with code execution can use it. However, post-exploitation activity following SYSTEM escalation that includes lateral movement, credential harvesting, and data staging is consistent with the Lazarus modus operandi.

Timeline

References

• Microsoft Security Update Guide — CVE-2026-68820
• NVD — CVE-2026-68820
• CISA KEV — CVE-2026-68820
• Check Point Research — Operation Dream Job