EUVD-2026-44020
GHSA-pr9w-vppj-jx9w
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network unauthenticated RCE with full impact, but AC:H because winning the CWE-362 race window requires precise timing and repeated attempts.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.
AnalysisAI
Remote code execution in the Microsoft Windows TCP/IP networking stack allows an unauthenticated attacker on the same physical or logical network segment to win a race condition and run arbitrary code on the target. The flaw spans a broad range of desktop and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, but Microsoft has confirmed the issue and shipped a patch, and the high CVSS (8.8) plus network-facing kernel component make it a priority to remediate.
Technical ContextAI
The vulnerable component is the Windows TCP/IP driver (tcpip.sys), the kernel-mode implementation of the IPv4/IPv6 protocol stack that processes every inbound packet. The root cause is CWE-362, a race condition: concurrent execution paths operate on a shared resource without proper synchronization, so an attacker who can precisely time packets can drive the stack into an inconsistent state that corrupts kernel memory and leads to code execution. Because this logic lives in the kernel and handles untrusted network input before any authentication layer, successful exploitation yields execution in a highly privileged context. The affected CPEs enumerate Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server editions from 2012 (including Server Core) through 2025.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for your specific Windows/Windows Server build as listed in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54999); the exact fixed KB/build number is not reproduced in the input data, so pull it per-edition from the advisory. Because the attack is adjacent-network only, the most effective compensating control until patching is network segmentation: isolate unpatched hosts on their own VLAN, restrict which peers share their link, and enforce 802.1X/port security so untrusted devices cannot join the segment - the trade-off is added network-management overhead and possible disruption to same-subnet services such as file sharing and discovery. Blocking or rate-limiting affected traffic at host firewalls can raise the bar but may break legitimate connectivity, so test before broad deployment. Prioritize internet-adjacent and shared-LAN servers, especially Server Core and 2012-era systems, first.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today