WhatBrokeToday
Today's Trends
highInvestigatingWindows

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

A use-after-free vulnerability (CVE-2026-68820) has been identified in the Microsoft Windows Ancillary Function Driver for WinSock. Stakeholders must apply vendor mitigations and follow CISA BOD 26-04 guidance.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Use-After-Free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    Microsoft Windows Ancillary Function Driver for WinSock : CVE-2026-68820 (Windows Ancillary Function Driver for WinSock Use-After-Free)(opens security advisory in a new tab)

    Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching…

    by CISA KEV 0upvotes 0comments

Timeline

  1. First report on security advisory

    Microsoft Windows Ancillary Function Driver for WinSock : CVE-2026-68820 (Windows Ancillary Function Driver for WinSock Use-After-Free)

    Source