Windows TCP/IP CVE-2026-50306

Exploitation requires the attacker to already possess authenticated local access with at least low/standard-user privileges on the target Windows system (CVSS PR:L, AV:L); it cannot be triggered remotely and needs no user interaction (UI:N). The attacker must be able to run code that drives TCP/IP kernel operations to hit the vulnerable free/use timing window. Limiting factors: the need for a pre-existing local foothold, the low but non-zero complexity of winning the use-after-free race and grooming kernel memory reliably, and the requirement that the host be an unpatched build in the affected Windows 10/11 or Server 2012-2025 range. Systems where untrusted users cannot obtain local sessions (e.g., single-admin workstations) face materially lower practical risk.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity and availability. This is a classic local elevation-of-privilege profile: the attacker must already have code execution as a standard user on the host, which limits the initial attack surface compared to a network-reachable RCE, but combined with any RCE or phishing foothold it provides a reliable path to SYSTEM. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced. The main risk driver is the extreme prevalence of the affected component (present on essentially every supported Windows build) rather than exploitation signals, making prompt patching worthwhile even though real-world risk today appears moderate rather than urgent.

An attacker who has already gained low-privileged code execution on a Windows host - for example through a phishing payload or a compromised standard user account - invokes crafted TCP/IP operations that trigger the use-after-free in the kernel networking stack. By grooming kernel memory to reclaim the freed object with attacker-controlled data, they corrupt kernel state to execute code as SYSTEM, completing a local privilege escalation. No public exploit is identified at time of analysis, and the local, low-complexity vector suggests reliable exploitation is feasible if a working technique is developed.