Researchers Release Exploit for Windows Kernel Flaw
Public proof-of-concept code targets CVE-2023-21768, a locally exploitable Windows driver vulnerability patched in January 2023.
Updated on Nov. 2, 2026 in Cybersecurity
Researchers Valentina Palmiotti and Ruben Boonen published a public proof-of-concept exploit for CVE-2023-21768, a Windows Ancillary Function Driver for WinSock flaw. The exploit targets vulnerable Windows 11 22H2 systems and requires only low-level local privileges.
Why it matters
The flaw lets a local attacker write to kernel memory because a memory pointer supplied from a user application was never checked. Public exploit code lowers the barrier for attackers on systems that have not yet applied Microsoft's January 2023 patch.
The public exploit was built from a compared analysis of December 2022 and January 2023 driver versions, with only the AfdNotifyRemoveIoCompletion function appearing changed. Its CVSS score of 7.8 reflects local, no-interaction exploitation rather than a remote internet route.
The players
Valentina Palmiotti
Security researcher who co-authored the analysis and proof-of-concept exploit for CVE-2023-21768.
Ruben Boonen
Security researcher who co-authored the analysis and proof-of-concept exploit for CVE-2023-21768.
IBM
Technology company that published the researchers' technical analysis of the vulnerability.
The details
The flaw sits in afd.sys, a Windows kernel driver, and the exploit changes Windows I/O ring objects to move from a limited memory write to broader control. The researchers reproduced and turned the flaw into a working exploit in about one day, and IBM reported that 360 IceSword Lab found a different exploit in the wild in January 2023.
Timeline
January 2023: Microsoft patched the vulnerability, and 360 IceSword Lab reportedly found a different in-the-wild exploit.
March 21, 2023: IBM published the researchers' technical analysis of the flaw.
November 2, 2026: The public proof-of-concept exploit was released on GitHub and reported.
Big Picture
The public release of a working exploit for afd.sys, a driver that handles WinSock networking inside the Windows kernel, shows how a patch can be reverse-engineered by comparing driver versions. Researchers who diff patched binaries can often produce exploitation code quickly, shortening the window between patch release and public attack capability.
Windows users on systems running Windows 11 22H2 should confirm the January 2023 Microsoft update is installed, since the public exploit works against unpatched machines. Because the flaw requires local access, the practical risk is highest on shared or multi-user computers.
The takeaway
Keeping Windows fully updated closes known kernel flaws before public exploit code makes them easier to abuse. Organizations should prioritize patching machines where untrusted users or software may already have local access.
Further reading
Explore more reporting in our Cybersecurity section.
Source note: This article includes information reported by Cyber Security News.
