CVE-2026-20831CWE-367

CVE-2026-20831

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition is hiding in the Windows Ancillary Function Driver for WinSock! An authorized attacker could escalate privileges without breaking a sweat.🔍 Think of it like a game of tag where one player checks in with the rules, but the other player has already crossed the finish line before the rules are even enforced. The attacker is exploiting a timing window, making it seem like everything’s fine right up until they seize the victory! If an attacker takes advantage of this race condition, they could elevate their privileges locally, gaining access to sensitive areas of the system that should remain locked up tight. This could lead to unauthorized changes, data theft, or even a full-blown system takeover. Definitely not a scenario you want to find yourself in!

Put simply

Think of it like a game of tag where one player checks in with the rules, but the other player has already crossed the finish line before the rules are even enforced. The attacker is exploiting a timing window, making it seem like everything’s fine right up until they seize the victory! The CVE-2026-20831 vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in the Windows Ancillary Function Driver for WinSock. It allows an authorized attacker to exploit the timing difference between checking permissions and using those permissions to execute further commands.

What to do

If an attacker takes advantage of this race condition, they could elevate their privileges locally, gaining access to sensitive areas of the system that should remain locked up tight. This could lead to unauthorized changes, data theft, or even a full-blown system takeover. Definitely not a scenario you want to find yourself in! To mitigate this issue, ensure your systems are updated by applying the latest security patches released by Microsoft. Regularly audit your user permissions to ensure compliance and monitor for any unauthorized changes. Don't wait – secure your systems now! This is fixable! Stay proactive, follow these steps, and you’ll keep those digital doors locked tight! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.6th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
    cvelistv5