EUVD-2026-44246
GHSA-fw6g-55xx-prrm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable driver flaw exploitable without auth or interaction (AV:N/PR:N/UI:N), but winning the race window makes AC:H; kernel code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows network driver affects a broad range of Windows client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Windows Server 2025), where a race condition (CWE-362) in the shared network driver lets an unauthenticated network attacker who wins a timing window run arbitrary code with full system impact. Microsoft has shipped fixes and rates it 8.1 with high attack complexity; there is no public exploit identified at time of analysis and CISA SSVC lists exploitation status as none, though the flaw is assessed as automatable with total technical impact. The EPSS probability is low (1.00%, 59th percentile), consistent with the high-complexity, not-yet-exploited profile.
Technical ContextAI
The defect is a concurrency flaw (CWE-362, improper synchronization of a shared resource) in the Windows Server Network driver - a kernel-mode component that processes network traffic. Because multiple threads operate on shared driver state without adequate locking, an attacker who can precisely time overlapping network operations can drive the driver into an inconsistent state (e.g., use-after-free or state corruption) that is leveraged for code execution in the kernel/system context. The affected CPEs span microsoft:windows_10 (1607, 1809, 21H2, 22H2), windows_11 (24H2, 25H2, 26H1), and windows_server (2012, 2012 R2, 2016, 2019, 2022, 2025) including Server Core installations, indicating the vulnerable driver ships across the entire modern Windows codebase rather than a single edition. The 'Authentication Bypass' tag alongside CWE-362 suggests the race can be abused to reach code paths without completing normal authentication.
RemediationAI
Apply the Microsoft cumulative security update for the affected platform, which raises the OS build past the fixed threshold for each version - for example Windows Server 2025 to 10.0.26100.33158, Windows Server 2022 to 10.0.20348.5386, Windows Server 2019 to 10.0.17763.9020, Windows Server 2012 to 6.2.9200.26226, Windows 11 24H2 to 10.0.26100.8875, and Windows 10 22H2 to 10.0.19045.7548; consult the per-version build numbers in the MSRC advisory before deploying. Patch status: Patch available per vendor advisory (Vendor-released patch: build thresholds listed above from EUVD/MSRC data). Because the flaw is in a network-facing driver and is remotely reachable, prioritize internet-facing and DMZ Windows Servers first. Until patching completes, reduce exposure by restricting network reachability to the affected service at the perimeter and host firewall (limit the relevant SMB/network-driver ports to trusted management subnets), which trades off remote administrative and file-sharing access for reduced attack surface; segment legacy Server 2012/2012 R2 hosts that may lag on updates. Full remediation details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today