EUVD-2026-29661
GHSA-jfvc-3h8q-fchp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local trigger by an already-authenticated low-privileged user (AV:L, PR:L), no user interaction, and a kernel overflow yielding SYSTEM gives full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.
Technical ContextAI
The vulnerability resides in the Windows TCP/IP stack (tcpip.sys), the kernel-mode driver that implements IPv4/IPv6 packet processing and socket handling. CWE-121 (stack-based buffer overflow) indicates that attacker-influenced data is copied into a fixed-size stack buffer without adequate bounds checking, corrupting the return address or adjacent stack structures within a kernel component. Because the CVSS vector is AV:L, exploitation is driven locally rather than by remote packets - most plausibly via crafted input to a local IOCTL/socket interface exposed by the driver. CPE data confirms the affected surface is the base OS component across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025, meaning this is a core OS-level defect, not a third-party product.
RemediationAI
Apply the Microsoft security update for your specific Windows build via Windows Update or WSUS/MECM; this is a Patch Tuesday-class OS fix. Vendor-released patched builds are: Windows 11 25H2 10.0.26200.8457, 24H2 10.0.26100.8457, 23H2/22H3 10.0.22631.7079, 26H1 10.0.28000.2113; Windows 10 21H2 10.0.19044.7291 and 22H2 10.0.19045.7291; Windows Server 2016/2019 10.0.14393.9140 and 10.0.17763.8755; Server 2022 10.0.20348.5139; Server 2022 23H2 Core 10.0.25398.2330; and Server 2025 10.0.26100.32860. Details and downloads are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40399. No official pre-patch workaround is published; because the tcpip.sys driver cannot be safely disabled without breaking all networking, the practical compensating controls are to restrict and monitor local/interactive logon rights so untrusted users cannot obtain the low-privileged foothold this exploit requires, and to enforce least privilege and EDR-based detection of kernel exploitation attempts. Prioritize multi-user, RDP/terminal, and shared-workstation hosts where local low-privileged access is more available.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today