Windows TCP/IP CVE-2026-40399

Exploitation requires the attacker to already hold valid low-privileged local access to the target Windows system (CVSS PR:L, AV:L) - this is not remotely reachable from the network despite the component being the TCP/IP stack. The trigger is crafted input to the vulnerable Windows TCP/IP (tcpip.sys) code path causing a stack-based buffer overflow; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first obtain an interactive or programmatic foothold on the host, reliable kernel stack-overflow exploitation typically requires bypassing modern mitigations (stack cookies, kernel ASLR, SMEP/CET), and SSVC rates the bug as not automatable with no observed exploitation, which constrains realistic mass abuse to skilled, targeted attackers.

The signals are internally consistent and point to a genuine but non-urgent local escalation risk. CVSS 7.8 breaks down as AV:L/AC:L/PR:L/UI:N with C:H/I:H/A:H, so an attacker who already has a low-privileged foothold can reliably (low complexity, no user interaction) gain full system compromise - matching SSVC 'Technical Impact: total.' However, SSVC also reports 'Exploitation: none' and 'Automatable: no,' EPSS is 0.06% (19th percentile), and the CVE is absent from CISA KEV with no POC referenced, so real-world exploitation likelihood is currently low. There is no conflict between sources: this is a high-severity-if-reached but low-probability issue, best treated as a standard patch-cycle priority for endpoints and servers rather than an emergency. The main escalation factor is that it is a local privilege escalation primitive that could be chained after an initial-access exploit, which is exactly how such Windows kernel bugs are typically weaponized once POCs emerge.

An attacker who has already gained low-privileged access to a Windows host - for example through a phished user account or a compromised service - invokes the vulnerable TCP/IP code path with crafted input to overflow a stack buffer in the kernel, overwriting control data and executing code as SYSTEM. With SYSTEM rights they disable defenses, harvest credentials, and move laterally. No public POC is currently identified, so real-world exploitation would require the attacker to develop a reliable kernel exploit.