KB5058383: Windows Server 2016 Security Update (May 2025)

An attacker with basic user privileges on the host — no admin rights needed — can issue crafted socket IOCTLs to trigger the use-after-free and escalate to SYSTEM. Because AFD is reachable from any unprivileged process, this is a reliable local-to-SYSTEM primitive that attackers chain after initial access (phishing, malware) to deploy ransomware or harvest credentials.

AFD.sys (the Ancillary Function Driver for WinSock) is the kernel-mode driver that backs Windows socket operations — it runs on every Windows host and is reachable from any process that uses sockets. A use-after-free flaw is triggered via crafted IOCTL calls or malformed WinSock interactions: a race condition in how AFD handles socket-descriptor metadata leaves stale pointers to reallocated buffers, which an attacker manipulates to corrupt kernel memory.

Probably yes if any of these apply:

Microsoft observed targeted attacks in healthcare and government in 2025 where the attacker, having gained a basic user foothold through phishing, used CVE-2025-32709 to escalate to SYSTEM via afd.sys, then deployed credential harvesters and ransomware. WinSock-driver EoPs are prized by intrusion operators because every process can reach the socket layer — the escalation works from the most constrained foothold.