CVE Watch26 de out. de 2026

CVE-2026-68820

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

CVSS

7.0

Alta

EPSS

8.6%

p95

KEV

SIM

11 de ago. de 2026

Exploit Today

0-100

Publicado: 11 de ago. de 2026 · Última mod.: 26 de out. de 2026 · CWE-416

EPSS · 30d

0.3%EPSS · 30 dias8.6%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Microsoft / Windows Ancillary Function Driver for WinSock

Vulnerabilidade

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Adicionado ao KEV

11 de ago. de 2026

Corrigir até

25 de ago. de 2026

Uso conhecido em ransomware

Não

Descrição resumida

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Ação necessária

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Notas

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-68820

Descrição técnica

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-934247.5 ALT

—

———FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.4h CVE-2026-69044—

3.4%

——1In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.1d CVE-2026-69043—

3.4%

——1In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption1d CVE-2026-824189.8 CRÍ

38.6%

——12IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.1d CVE-2026-1219635.9 MÉD

23.8%

——7FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.8h CVE-2026-1219557.5 ALT

36.2%

——11FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.8h