Microsoft Windows CVE-2026-50307

Exploitation requires the attacker to already possess local code execution on the target as a low-privileged authenticated user (CVSS PR:L, AV:L) - this is a post-access privilege-escalation primitive, not a remotely reachable network flaw despite the component being TCP/IP. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access exists exploitation is straightforward against affected default builds. Limiting factors: the attacker must first obtain an interactive or programmatic foothold on the host, and the system must be on a pre-fix build (e.g. Windows 11 24H2 below 10.0.26100.8875); SSVC rates the flaw non-automatable, indicating it is not trivially wormable.

Signals are consistent and point to a real but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) indicates local access with low existing privileges and no user interaction, with total impact to confidentiality, integrity, and availability - matching SSVC's 'Technical Impact: total'. However SSVC also rates Exploitation as 'none' and Automatable 'no', and EPSS is only 0.20% (10th percentile), so mass or automated exploitation is unlikely in the near term. This is not in CISA KEV and no public exploit is identified, so it is a patch-in-normal-cycle item rather than an emergency: dangerous as a post-compromise escalation primitive, but requiring an attacker to already have a foothold. No conflicting signals were observed - the local vector, low EPSS, and SSVC 'none' all align.

An attacker who has already gained a low-privileged foothold - for example via phishing, a compromised service account, or a standard user session on a shared server - runs a crafted local program that triggers the use-after-free in the TCP/IP driver, reclaims the freed kernel allocation, and escalates to SYSTEM to disable defenses or move laterally. No user interaction is required and the local attack complexity is low, but the attacker must already have code execution on the host; no public proof-of-concept has been identified at time of analysis.