Windows TCP/IP CVE-2026-33837

Exploitation requires the attacker to already have authenticated local access to the target Windows host as a low-privileged user (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not a remotely reachable network bug despite residing in the TCP/IP stack. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local code execution is achieved the escalation is straightforward. Limiting factors: the attacker must first obtain a foothold/valid credentials on the machine, the target must be an unpatched build in the affected range, and the scope is unchanged (S:U), meaning impact is confined to the compromised host rather than crossing a trust boundary to other systems.

The signals are consistent and point to a moderate, non-urgent priority. CVSS 7.8 is driven by high confidentiality/integrity/availability impact (C:H/I:H/A:H) and total technical impact per SSVC, but the exploit prerequisites temper it: AV:L means no remote reachability, and PR:L means the attacker must already be an authenticated local user. Corroborating this, SSVC records Exploitation: none and Automatable: no, and EPSS is very low at 0.06% (18th percentile), so mass or automated exploitation is unlikely in the near term. There is no KEV listing and no POC signal in the data, so this is a genuine kernel EoP worth patching in normal cycles rather than an emergency. Note the CVSS despite AV:L still reflects a high-severity outcome (kernel SYSTEM), so it should not be dismissed on low-EPSS grounds alone - it is a classic post-compromise escalation primitive.

An attacker who has already obtained a low-privileged local account (e.g. via phishing, a compromised service, or a foothold on a shared server) runs a crafted program that drives the vulnerable Windows TCP/IP code path to overflow a kernel heap buffer. By grooming the pool and corrupting adjacent kernel objects, they escalate from the limited user context to SYSTEM, gaining full control of the host. No public exploit is identified at time of analysis, and the low AC means that if code were developed, execution would be reliable for a local attacker.