The Ancillary Function Driver (AFD) use-after-free in CVE-2026-70307 is being undersold by its CVSS 7 rating. The 'authorized local attacker' qualifier creates a dangerous blind spot: it frames this as an isolated privilege escalation bug when AFD occupies a structural position that makes it a systemically risky component in any Windows environment.
AFD sits at the kernel-user boundary for all Winsock operations — every socket call on Windows crosses through this driver. A use-after-free here isn't ordinary heap corruption; it's a controlled memory corruption primitive in a component with kernel-level access. In enterprise environments with domain-joined workstations, the attack chain is straightforward: compromise any standard-user workstation (phishing, credential reuse, browser exploit), then leverage this UAF for reliable SYSTEM elevation, extract domain tokens, and pivot to domain admin. The CVSS model evaluates this in isolation; real attackers evaluate the operational environment where they'll actually exploit it.
What should concern defenders more than the specific bug is the pattern. AFD vulnerabilities recur across Windows servicing cycles not because of individual developer errors, but because AFD is legacy infrastructure — a 30-year-old interface contract that nobody actively develops but every Windows application depends on. Each patch introduces new memory management patterns under unusual socket conditions that weren't tested, creating the conditions for the next UAF in adjacent code paths. This isn't speculation; it's the structured recurrence visible across a decade of AFD patches.
For your environment, treat this as infrastructure-level risk regardless of the CVSS score. Prioritize patching domain-joined workstations aggressively. If your patch cadence for 'authorized attacker' CVEs runs to 30-90 days, this component's history suggests that window is where exposure lives. Monitor your post-exploitation tooling for AFD exploitation primitives — if your red team can weaponize this, an adversary can too. The 'authorized attacker' framing has historically preceded reliable framework-integrated exploitation paths emerging within 2-4 patch cycles; treat that history as a warning, not a guarantee of safety.