EUVD-2026-35727
GHSA-3pg4-4j29-q4rr
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
Incorrect calculation of buffer size in Windows TCP/IP allows an authorized attacker to deny service over an adjacent network.
AnalysisAI
Denial-of-service in the Windows TCP/IP stack allows an authenticated attacker on an adjacent network to crash the networking subsystem of affected Windows hosts via an incorrect buffer size calculation. Affected systems span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 - all unpatched builds within Microsoft-documented version ranges. No public exploit identified at time of analysis, though Microsoft has released fixes addressable via Windows Update; the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the Windows TCP/IP networking stack, the kernel-mode component responsible for processing all inbound and outbound network traffic on Windows systems. CWE-131 (Incorrect Calculation of Buffer Size) describes a root cause where software computes an erroneous size for a memory buffer - most commonly too small - causing subsequent write operations to overflow the boundary or triggering a crash when the stack attempts to process data that exceeds allocated space. In the TCP/IP context, this likely manifests during packet parsing, reassembly, or option field processing, where a malformed or crafted packet causes the stack to miscalculate buffer requirements. The adjacent network attack vector (AV:A) constrains exploitation to the same broadcast domain, VLAN, or directly attached subnet as the target - consistent with link-layer or subnet-local TCP/IP processing before routing occurs. Affected CPE data (inferred from ENISA EUVD-2026-35727) covers the core Windows OS across consumer and server SKUs from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2022/2025.
RemediationAI
Apply the Microsoft-released patch via Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog targeting the following fixed builds: Windows Server 2022 build 10.0.20348.5256 or later; Windows 10 21H2 build 10.0.19044.7417 or later; Windows 10 22H2 build 10.0.19045.7417 or later; Windows 11 23H2 build 10.0.22631.7219 or later; Windows 11 24H2 build 10.0.26100.8655 or later; Windows Server 2025 and Server 2025 Core build 10.0.26100.32995 or later; Windows 11 25H2 build 10.0.26200.8655 or later; Windows 11 26H1 build 10.0.28000.2269 or later. The full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42915. For systems where immediate patching is not feasible, apply VLAN isolation to ensure unpatched Windows hosts do not share a broadcast domain with untrusted or potentially compromised authenticated users - this directly addresses the AV:A prerequisite and eliminates adjacency-based exploitation. Additionally, enforce network access control (NAC) policies to prevent unauthorized authenticated devices from joining trusted segments. Note that VLAN isolation may affect legitimate peer-to-peer network services. No workaround eliminates the underlying CWE-131 defect; patching remains the only definitive remediation.
More in Windows 10 21h2
View allWindows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. Rated critical severity (CVSS 9.8), thi
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Same weakness CWE-131 – Incorrect Calculation of Buffer Size
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today