What is the CVSS score of CVE-2026-34334?

CVE-2026-34334 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows TCP/IP are affected by CVE-2026-34334?

A local privilege escalation vulnerability in the Windows TCP/IP stack (CVE-2026-34334) affects essentially all Windows 10, 11, and Server systems in your organization.. A patch is available.

How to fix or mitigate CVE-2026-34334?

Within 24 hours, confirm patch availability from Microsoft and prioritize deployment planning by system criticality, ranking tier 1 as domain controllers and administrative systems, tier 2 as general user devices, and tier 3 as non-production systems. Within 7 days, deploy patches to all Tier 1 systems and implement monitoring for suspicious privilege escalation attempts. Within 30 days, complete deployment to all Windows systems and validate patch application across the enterprise.

Windows TCP/IP CVE-2026-34334

EUVD-2026-29594 HIGH

Race Condition (CWE-362)

2026-05-12 microsoft

GHSA-48gq-9w8x-r7fj

Information Disclosure Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 22H3 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local authenticated access (AV:L/PR:L); AC:H because winning a race condition needs precise timing and repeated attempts; total kernel impact gives C:H/I:H/A:H, scope unchanged.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:26 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.

Technical ContextAI

The flaw is CWE-362 (concurrent execution using a shared resource with improper synchronization, i.e. a race condition) in the Windows TCP/IP driver (tcpip.sys), a kernel-mode component that processes networking state and is reachable by local user-mode code through socket and IOCTL interfaces. Because the affected code path runs in the kernel, an attacker who can influence timing on a shared resource that lacks proper locking can cause a state inconsistency (e.g. use-after-free, double-handling, or TOCTOU on a shared structure) that yields kernel-level code execution or memory corruption. The CPE list confirms this is Microsoft first-party operating-system code spanning Windows 10 (1607/1809/21H2/22H2), Windows 11 (22H3/23H2/24H2/25H2/26H1), and Windows Server 2012/2016/2019/2022/2025, meaning the vulnerable synchronization logic is shared across the common TCP/IP stack lineage rather than a single SKU.

RemediationAI

Apply the Microsoft security update for your specific build, guided by the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34334 (Vendor-released patch: install the cumulative update that brings the OS to or above the fixed build for your version - for example 10.0.26100.8457 for Windows 11 24H2, 10.0.20348.5139 for Windows Server 2022, 10.0.17763.8755 for Windows 10 1809 / Server 2019, and 6.2.9200.26079 for Windows Server 2012). Because this is a core kernel networking component with no configurable feature to disable, there is no clean product-level workaround; the practical compensating control until patching is to limit local interactive and low-privilege logon access on affected hosts - tighten who can run code on multi-user, RDP/terminal-server, and jump hosts, and monitor for anomalous local privilege-escalation behavior - accepting that this only reduces the attacker population rather than closing the race condition. Prioritize patch deployment on shared systems where untrusted or many users have local sessions.