Windows TCP/IP CVE-2026-34334

The attacker must already have local, authenticated access to the target host with at least low-level user privileges (CVSS PR:L, AV:L) - this is not remotely reachable and requires no user interaction from a victim. The specific prerequisite is the ability to run code locally that repeatedly exercises the vulnerable Windows TCP/IP synchronization path to win a timing race on a shared kernel resource; reliability is inherently limited because winning a race condition demands precise timing and often many attempts, which is why CISA SSVC marks it not automatable and EPSS is 0.04%. Exploitation is further limited to unpatched builds below the fixed versions listed in the EUVD data; hosts where untrusted users cannot obtain a local session are effectively out of reach.

The signals are internally consistent toward a moderate, non-urgent priority. The CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local-only access with low privileges but total impact. EPSS is very low (0.04%, 12th percentile) and CISA SSVC records Exploitation: none and Automatable: no, so there is no evidence of active or scalable exploitation - this is not KEV-listed. One notable tension: Microsoft rated attack complexity as AC:L, yet the root cause is a race condition, which typically requires precise timing and repeated attempts to win reliably; a more conservative independent assessment would rate AC:H, which better matches the low EPSS and 'not automatable' SSVC judgment. A second discrepancy: the intelligence Tags include 'Information Disclosure', while the description and CVSS vector describe local elevation of privilege with high integrity/availability impact - verify the exact primary impact with the vendor advisory. Net: reachable only by a local authenticated user, no known exploit, high impact if weaponized - patch in normal cycle, prioritizing multi-user and shared/terminal-server hosts.

A low-privileged but authenticated user on a shared Windows host (for example an RDP session host or a workstation with a standard-user account) runs a local program that rapidly and repeatedly drives the vulnerable TCP/IP code path to win the timing window on an improperly synchronized shared kernel resource. Winning the race corrupts kernel state and lets the attacker execute code with SYSTEM privileges, taking full control of the machine. No public exploit is identified at time of analysis, and success requires many timing attempts, consistent with the race-condition nature and low EPSS.