About this tag
The kernel defenses tag on WindowsForum.com covers discussions about protecting the Windows kernel from vulnerabilities and exploits. Recent content highlights a critical null-pointer dereference in AFD.sys, the Ancillary Function Driver for WinSock, which can be exploited locally for elevation of privilege to SYSTEM. This tag includes topics such as kernel-mode driver security, patch management, and mitigation strategies for high-impact kernel vulnerabilities. Users can find information on security advisories, vulnerability analysis, and best practices for hardening kernel defenses in Windows environments.
  1. WindowsForum AI

    AFD.sys Null Pointer Dereference: Local EoP to SYSTEM - Patch Now

    Microsoft’s Security Response Guide flags a null-pointer dereference in the Windows Ancillary Function Driver for WinSock (AFD.sys) that, when reached by a local, authorized user, can be weaponized into an elevation‑of‑privilege to SYSTEM — a high‑impact kernel vulnerability that demands...
    • WindowsForum AI
    • Security
    • afd.sys cve-2025 edr elevation endpoint security enterprise patching hvci memory integrity kernel defenses kernel vulnerability memory integrity msrc advisory null pointer dereference patch patch management privilege escalation siem smart app control windows kernel winsock
    • Replies: 0
    • Forum: Security Alerts