Windows TCP/IP CVE-2026-49177

Exploitation requires local access to an affected Windows system with at minimum a low-privileged (standard user) authenticated account, as confirmed by the CVSS vector PR:L and AV:L. The attacker must be able to execute code on the target system - via an interactive logon, RDP session, or another form of code execution. No network-facing exposure is indicated; the flaw is not remotely triggerable over TCP/IP despite residing in the TCP/IP stack, meaning it cannot be exploited by an unauthenticated remote attacker sending crafted packets. No specific non-default configuration or enabled feature is identified in the available data as a prerequisite. Exploitation is limited to confidentiality impact only (I:N, A:N), with no scope change (S:U), so the attacker cannot leverage this flaw alone to escalate privileges or disrupt service - a separate vulnerability would be required to convert the disclosure into a more impactful chain.

The CVSS 3.1 base score of 5.5 (Medium) reflects the constrained local attack vector (AV:L), low privilege requirement (PR:L), and the limited scope of impact (confidentiality only, C:H/I:N/A:N, S:U). These metrics are internally consistent: the flaw is not remotely exploitable and requires a valid user-level account, sharply limiting attacker reach. EPSS corroborates this - at 0.31% (22nd percentile), automated exploitation activity is not anticipated. SSVC aligns: exploitation status is none, the attack is not automatable, and technical impact is rated partial. No CISA KEV listing is present and no POC is publicly available, so this is not a real-priority emergency. The primary concern is privilege escalation chains: if combined with a separate local privilege escalation vulnerability, the memory disclosure could facilitate ASLR bypass or credential harvesting. The breadth of affected products (over a dozen Windows versions including legacy Server 2012) elevates patch-management complexity without changing the immediate exploitation urgency. Overall: a routine patch-cycle item warranting timely remediation but not emergency response.

A standard domain user or local account holder logs into an affected Windows system (interactive session or RDP), then executes a crafted local process that issues specially formed TCP/IP stack calls - such as manipulated socket operations or ioctl requests - designed to trigger the out-of-bounds read in the kernel TCP/IP driver. The read returns memory contents from adjacent kernel pool regions, which the attacker processes to harvest sensitive data such as kernel pointers (potentially usable for ASLR bypass in a chained attack) or fragments of other processes' memory. No public exploit code exists at time of analysis, so an attacker would need to independently develop the trigger.