EUVD-2026-73482
GHSA-p5rm-mm27-cm2m
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only race condition requiring low-privileged account and timing precision (AC:H); no scope change; full kernel-level C/I/A impact on successful exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a locally authenticated user account with at minimum standard (low-privilege) access - PR:L per the CVSS vector - and the ability to execute arbitrary code on the target system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.0 score with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the key tension: full C/I/A impact offset by local-only attack vector and high complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-issued security update via Windows Update or WSUS, targeting the fixed builds per platform: Windows 10 22H2 → 10.0.19045.7725, Windows 11 24H2 → 10.0.26100.9445, Windows 11 25H2 → 10.0.26200.9445, Windows 11 26H1 → 10.0.28000.2954, Windows Server 2025 → 10.0.26100.33438, Windows Server 2022 → 10.0.20348.5622, Windows Server 2019/1809 → 10.0.17763.9245, Windows Server 2016/1607 → 10.0.14393.9512, Windows Server 2012 R2 → 6.3.9600.23397, Windows Server 2012 → 6.2.9200.26349. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all affected Windows systems spanning Server 2012 through Windows 11 26H1, prioritizing multi-user and shared-access environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today