Security researchers have published a fully functional proof-of-concept exploit targeting CVE-2023-21768, a Windows vulnerability tied to the Ancillary Function Driver (AFD) for WinSock that allows attackers with local privileges to escalate to SYSTEM rights. The exploit specifically impacts Windows 11 version 22H2 devices still missing Microsoft’s January 2023 patch.
What the vulnerability is
The flaw exists in afd.sys, the kernel driver handling WinSock networking interface calls. Prior to the January 2023 fix, one of its functions—AfdNotifyRemoveIoCompletion—failed to validate a memory pointer provided by user-mode applications. This oversight permitted local users to write directly into protected kernel memory, setting the stage for privilege escalation.
The issue was baked into Windows 11 22H2 builds released prior to Microsoft’s patch. The lack of user interaction and relatively low-privilege access required make it especially dangerous. However, it cannot be exploited remotely over a network—attackers must already have some level of access.
The public proof-of-concept and implications
This exploit was developed by two researchers, known as “chompie” and Ruben Boonen, after reviewing driver versions from December 2022 and January 2023 to spot what Microsoft changed. The flaw was isolated to the missing pointer validation in AfdNotifyRemoveIoCompletion. After studying the patched vs. unpatched driver, they created an exploit chain that works reliably on vulnerable Windows 11 22H2 machines. Key steps involve leveraging kernel memory write and read primitives, then replacing a target process’s security token with one that carries SYSTEM privileges.
The exploit code has been released on GitHub as a demonstration. While full privilege escalation is confirmed on 22H2, the underlying memory-write primitive appears to apply more broadly across other vulnerable Windows versions. The demonstration bypasses Hypervisor-Code Integrity (HVCI), meaning the Microsoft security feature doesn’t block it—reinforcing that updates are essential.
Notably, another exploit predating this public release was discovered in the wild in January 2023. That variant leveraged the ProcessSocketNotifications interface rather than the afd.sys direct driver path used in the public proof-of-concept. There’s no evidence that the public GitHub release was used by attackers in those earlier incidents.
Mitigation steps
Administrators and users should verify that their Windows devices have applied Microsoft’s January 2023 security updates—or any updates released since then addressing CVE-2023-21768. As patching remains the safest defense, relying solely on protections like HVCI is insufficient. Ensuring operating systems are up to date remains critical.
This vulnerability is part of a series of flaws in the WinSock driver space. Related disclosures include CVE-2024-38193 and CVE-2025-32709, each affecting the same driver but representing separate bugs with distinct patches.
This development underscores how even patched vulnerabilities can become risk-multipliers when proof-of-concept exploit code becomes public. Once the engineering fix is understood, attackers can replicate or adapt the exploit quickly, especially in widely deployed systems like Windows 11 22H2. It’s a reminder that timely patching must remain a priority for organizations and individuals alike—especially given that mitigations like HVCI, while useful, are no substitute for the full hotfix. Watch outputs from threat intelligence feeds for signs of abuse, particularly in environments where rollback or update delays are common.
