EUVD-2026-35593
GHSA-3f78-xrf3-9xc8
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.
AnalysisAI
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to gain elevated privileges by triggering a heap-based buffer overflow (CWE-122). The CVSS 9.6 score with scope change (S:C) indicates the compromise crosses security boundaries beyond the vulnerable component itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The flaw resides in the Windows TCP/IP stack, the kernel-mode driver (tcpip.sys) responsible for processing IPv4/IPv6 packets, ICMP, and related protocols on all supported Windows client and server SKUs. CWE-122 (Heap-Based Buffer Overflow) indicates that malformed or oversized network input causes a write past the bounds of a heap-allocated buffer, corrupting adjacent kernel pool memory. Because this code runs at SYSTEM/kernel privilege level, controlled heap corruption can be leveraged to escalate privileges or achieve arbitrary kernel execution. The Microsoft-credited reporter (secure@microsoft.com) and the MSRC advisory reference confirm this is a Microsoft-internal-tracked issue in core OS networking.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904 via Windows Update, WSUS, or your enterprise patching pipeline; the exact KB article and patched build numbers are listed on the MSRC page. As compensating controls until patching completes, segment untrusted devices off corporate LANs and guest Wi-Fi using VLANs or 802.1X to eliminate adjacent-network reachability, and enforce IPsec or strict host firewall rules to drop unsolicited inbound IPv4/IPv6 traffic from untrusted peers - note that disabling IPv6 entirely is discouraged by Microsoft and may break services such as DirectAccess, Teams, and certain Active Directory functions. For highly exposed assets like jump hosts on shared segments, consider temporary isolation behind a Layer-3 firewall until the patch is deployed.
More in Windows 10 21h2
View all<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today