EUVD-2026-29672
GHSA-mw9q-gfjj-7mhx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote packets reach the TCP/IP stack (AV:N/PR:N/UI:N), but reliable exploitation requires winning a kernel use-after-free race (AC:H); kernel RCE yields total C/I/A.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw carries CVSS 8.1 but requires winning a memory-corruption race (AC:H), and there is no public exploit identified at time of analysis; EPSS is very low at 0.09% and CISA SSVC lists exploitation as none. A vendor patch is available from Microsoft.
Technical ContextAI
The vulnerability lives in the Windows TCP/IP kernel networking driver (tcpip.sys), the core component that parses and processes IPv4/IPv6 and TCP/UDP traffic for every affected Windows build. CWE-416 (use-after-free) means the driver references a heap object after it has been freed - typically a race between packet processing and object teardown - allowing an attacker who crafts a specific sequence of network packets to reclaim the freed allocation with attacker-controlled data and corrupt kernel memory. Because tcpip.sys runs in kernel mode, successful control of the freed object yields code execution at the highest privilege level. The CPE and EUVD data confirm the affected surface is the OS networking stack itself rather than any optional service, spanning Windows 10 (1809, 21H2, 22H2), Windows 11 (22H3/23H2/24H2/25H2/26H1), and Windows Server 2019/2022/2022-23H2/2025.
RemediationAI
Apply the Microsoft security update for your specific Windows build as the primary fix - Vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415, updating to at or above the fixed build for your edition (e.g., 10.0.19045.7291 for Windows 10 22H2, 10.0.22631.7079 for Windows 11 23H2, 10.0.26100.8457 for 24H2/Server 2025, 10.0.20348.5139 for Server 2022, 10.0.17763.8755 for Server 2019/Windows 10 1809). Because the vulnerable code is in the core TCP/IP driver there is no feature to disable as a clean workaround; if patching must be delayed, reduce exposure by restricting inbound network reachability to the affected hosts using host and perimeter firewall rules (limit which sources can reach the systems and drop unsolicited inbound TCP/IP/IPv6 traffic), and consider disabling IPv6 only if it is unused in your environment and confirmed not to break dependent services - noting that firewall restriction reduces but does not eliminate risk from trusted network segments and may impact legitimate connectivity. These are compensating controls only; the patch is the sole complete remediation.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today