EUVD-2026-43989
GHSA-wxj8-fwp7-7c8v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local trigger (AV:L), low-privilege account required (PR:L), confidentiality-only impact with no integrity or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a class of memory-safety defect where code reads beyond the end of a valid buffer, potentially exposing adjacent memory contents to the caller. In this case the flaw resides in the Windows TCP/IP networking stack - the kernel-mode driver responsible for processing IP, TCP, and UDP traffic on every affected Windows system. Because TCP/IP processing occurs in kernel space, an out-of-bounds read in this component can expose kernel memory structures, stack data, or pool allocations that should be inaccessible to user-mode callers. The CPE strings confirm the affected application-level component (cpe:2.3:a:microsoft:windows_*) across Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through Server 2025. The local attack vector (AV:L) indicates the read is triggered through a local interface - likely a crafted socket call, ioctl, or network-stack interaction initiated from user space - rather than over the network.
RemediationAI
Apply Microsoft's cumulative update patches as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49177. Verified fixed builds per EUVD-2026-43989 are: Windows Server 2025 / Server Core 10.0.26100.33158 or later; Windows Server 2022 10.0.20348.5386 or later; Windows Server 2019 / Server Core 10.0.17763.9020 or later; Windows Server 2016 / Server Core 10.0.14393.9339 or later; Windows Server 2012 R2 / Server Core 6.3.9600.23291 or later; Windows Server 2012 / Server Core 6.2.9200.26226 or later; Windows 11 24H2 and 25H2 10.0.26100.8875 or later; Windows 11 26H1 10.0.28000.2269 or later; Windows 10 21H2 10.0.19044.7548 or later; Windows 10 22H2 10.0.19045.7548 or later; Windows 10 1607 10.0.14393.9339 or later; Windows 10 1809 10.0.17763.9020 or later. For Windows Server 2012 and 2012 R2, which are past mainstream support, verify eligibility under Extended Security Updates (ESU) before applying patches - organizations without ESU coverage should prioritize migration to a supported OS version. As a compensating control while patches are staged, restrict local interactive and remote (RDP/console) logon rights to sensitive systems to the minimum required accounts via Group Policy, reducing the pool of principals who can trigger the vulnerability. This does not eliminate the flaw but raises the attacker's entry bar.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today