CVE-2026-50462

Analyzed Analyzed - Analysis Complete

External Control of File Name in Windows Ancillary Function Driver for WinSock

Publication date: 2026-07-14

Last updated on: 2026-07-22

Assigner: Microsoft Corporation

Description

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-22

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50462

EUVD

EUVD-2026-44055

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_11_26h1	to 10.0.28000.2269 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_server_2016	to 10.0.14393.9339 (exc)
microsoft	windows_server_2019	to 10.0.17763.9020 (exc)
microsoft	windows_server_2022	to 10.0.20348.5386 (exc)
microsoft	windows_server_2025	to 10.0.26100.33158 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2525 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

CVE-2026-50462 is a vulnerability in the Windows Ancillary Function Driver for WinSock. It involves external control of a file name or path, which means an attacker can manipulate file paths or names in a way that the system does not intend.

This vulnerability allows an authorized attacker with local access to elevate their privileges on the affected system. Privilege elevation means the attacker can gain higher-level permissions, such as administrative rights, which they would not normally have.

Impact Analysis

If you are using a system with the Windows Ancillary Function Driver for WinSock, this vulnerability could impact you in the following ways:

An attacker with local access to your system could exploit this vulnerability to gain elevated privileges.
With elevated privileges, the attacker could perform unauthorized actions such as installing malicious software, accessing or modifying sensitive data, or disrupting system operations.
This could lead to a complete compromise of the affected system, potentially allowing the attacker to take full control.

Compliance Impact

This vulnerability could impact compliance with common standards and regulations in the following ways:

GDPR: If the affected system processes personal data of EU citizens, a successful exploit could lead to unauthorized access or modification of this data. This may result in a breach of GDPR requirements, particularly those related to data protection and security (e.g., Article 32).
HIPAA: For organizations handling protected health information (PHI), this vulnerability could lead to unauthorized access or disclosure of PHI. This would violate HIPAA's Security Rule, which mandates safeguards to protect the confidentiality, integrity, and availability of PHI.
Other standards: Compliance frameworks like ISO 27001, NIST, or PCI DSS require organizations to maintain secure systems and protect against unauthorized access. Exploitation of this vulnerability could indicate a failure to meet these requirements, potentially leading to non-compliance.

Mitigation Strategies

Apply the security update provided by Microsoft to address CVE-2026-50462. The update will patch the vulnerability in the Windows Ancillary Function Driver for WinSock.

To obtain the update, visit the Microsoft Security Response Center (MSRC) update guide for this CVE.

Hi! I’m here to help you understand CVE-2026-50462. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70