EUVD-2026-73047
GHSA-m95c-jj6m-898p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged network access
-
DeliverySend crafted TCP/IP packets
-
ExploitTrigger use-after-free race in kernel driver
-
ExecutionGroom freed kernel object
-
PersistCorrupt kernel memory
-
ImpactElevate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Windows kernel TCP/IP stack (tcpip.sys) and requires the attacker to already hold low privileges (PR:L) and to reach the target over the network (AV:N); no user interaction is needed (UI:N). The key limiting factor is AC:H: success depends on winning a use-after-free race window in kernel memory, which is difficult to trigger reliably and is not automatable per CISA SSVC. Affected are current in-support Windows builds below the patched revisions (e.g., Windows 10 1809 <10.0.17763.9245, 21H2/22H2 <10.0.19044/19045.7725, Windows 11 23H2 <10.0.22631.7582, 24H2/25H2 <10.0.26100/26200.9445, 26H1 <10.0.28000.2954, Server 2019 <10.0.17763.9245, Server 2022 <10.0.20348.5622, Server 2025 <10.0.26100.33438); applying the vendor update removes exposure. |
| Impact | This is a legitimate but not top-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 HIGH) describes a network-reachable use-after-free in the Windows TCP/IP stack requiring low privileges and no user interaction, with total impact to confidentiality, integrity, and availability. Crucially, AC:H signals a hard-to-win condition - consistent with a use-after-free (CWE-416) that depends on a memory-corruption race window, meaning reliable exploitation is non-trivial. Multiple independent signals downgrade urgency relative to the 7.5 base: EPSS is 0.65% (~49th percentile), CISA's SSVC scores Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' (not amenable to mass/wormable exploitation), even though Technical Impact is 'total'. There is no KEV listing and no public exploit. One notable framing inconsistency: the description says the flaw 'allows an authorized attacker to elevate privileges over a network,' pairing an EoP outcome with a network vector - unusual phrasing that likely reflects a network-triggered kernel corruption yielding SYSTEM-level control; the CVSS metrics (AV:N, PR:L, total impact) are internally consistent with that reading. Net: a real, patch-now-in-cycle kernel bug, but current evidence points to it being a high-CVSS/lower-real-risk item absent a working exploit, not an emergency. |
| Exploit ScenarioDerived | A low-privileged authenticated foothold (or an attacker able to send crafted traffic that the target's TCP/IP stack processes on behalf of a low-priv context) sends specially crafted network packets that trigger a use-after-free in the Windows kernel TCP/IP driver, corrupting kernel memory. By winning the race and grooming the freed object, the attacker escalates to SYSTEM. No public proof-of-concept exists and the AC:H race condition makes reliable weaponization difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 22, 2026
Privilege escalation in the Microsoft Windows TCP/IP kernel stack lets an authenticated attacker who already holds low privileges on a reachable host corrupt kernel memory over the network and escalate to SYSTEM, with high impact to confidentiality, integrity and availability. Exploitation hinges on winning a use-after-free race in tcpip.sys, which is why the vector carries AC:H and CISA SSVC rates the issue as not automatable with no observed exploitation; EPSS is 0.65 percent (49th percentile), and no public exploit was identified at time of analysis. All in-support Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds below the vendor's fixed revisions are affected, and Microsoft has released patches.
Earlier versions of this analysis (1)
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
RemediationAI
Vendor-released patch: Microsoft has published fixed kernel builds, and the primary remediation is to apply the current cumulative update so each branch reaches or exceeds its patched revision - Windows 10 1809 and Server 2019 to 10.0.17763.9245, Windows 10 21H2 to 10.0.19044.7725, Windows 10 22H2 to 10.0.19045.7725, Windows 11 23H2 to 10.0.22631.7582, Windows 11 24H2 to 10.0.26100.9445, Windows 11 25H2 to 10.0.26200.9445, Windows 11 26H1 to 10.0.28000.2954, Server 2022 to 10.0.20348.5622, and Server 2025 to 10.0.26100.33438; see the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69757 for the exact KB mapping per build. Because this is a kernel race condition in tcpip.sys, there is no configuration toggle that removes the defect - the patch is the only complete fix, and disabling TCP/IP itself is not a viable workaround. Until patching completes, compensate by restricting network reachability to hosts that do not need to accept traffic from semi-trusted, low-privileged principals (segmentation and host firewall rules limiting which subnets can initiate connections to servers), which reduces the pool of attackers who can satisfy the PR:L prerequisite but has no effect if a low-privileged account already exists on a reachable host; enforce least privilege so that standard user accounts are not provisioned where avoidable; and monitor for unexpected kernel bugchecks, reboots and tcpip.sys-related crash dumps as a detection signal for race-based corruption. Prioritize internet- and DMZ-facing servers and multi-tenant or jump-host systems where untrusted low-privileged users coexist, noting that EPSS is low (0.65 percent) and no exploitation has been observed, so this is a legitimate but not top-tier emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 12 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the Windows kernel TCP/IP implementation (tcpip.sys, reachable through the Windows networking stack), where a network-triggered network structure is released while a reference is still in use, allowing the freed kernel pool block to be reallocated and manipulated by the attacker. Successful exploitation yields kernel-mode memory corruption that the attacker converts into privileged code execution, hence the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - network reachable, requiring pre-existing low privileges (PR:L, i.e. authenticated), no user interaction, and unscoped impact with high confidentiality, integrity and availability. The AC:H rating reflects the difficulty of reliably hitting the race window in kernel memory, and CISA SSVC concurs with Exploitation: none, Automatable: no, and Technical Impact: total. CPE data confirms the affected platform set spans Windows 10 1809/21H2/22H2 (x86, x64, arm64), Windows 11 23H2 (and, per EUVD version data, 24H2, 25H2 and 26H1), and Windows Server 2019, 2022 and 2025 including Server Core installations.
Know when Windows 10 1809 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-triggered kernel UAF with a race window justifies AV:N and AC:H; an authorized low-priv attacker gives PR:L; SYSTEM-level kernel compromise yields total C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A memory-corruption flaw in the Windows TCP/IP kernel stack (tcpip.sys) lets an attacker who already holds low-privileged access on a network-reachable host escalate to full SYSTEM control, affecting unpatched Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 systems across the estate. Exploitation requires an existing foothold and a timing-dependent race condition, so it is not automatable and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is escalation that converts a contained intrusion into complete host takeover. Microsoft has released patches, making this a straightforward remediation rather than an emergency containment scenario.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Exploit-DB