Windows IP Helper CVE-2026-72981

No authentication is required and no user interaction is needed - PR:N and UI:N confirm that exploitation is possible from an unauthenticated remote position against any reachable Windows host. The primary limiting factor is attack complexity (AC:H): reliable exploitation requires achieving a specific heap state or race-condition timing window in the IP Helper service, which reduces the likelihood of automated mass-exploitation compared to straightforward memory-corruption bugs. The IP Helper service runs in a network-accessible context on all default Windows installations, meaning no special configuration or optional feature activation is needed to expose the vulnerable code path. Exploitation is limited to Windows hosts running unpatched builds across the full version range; Windows hosts updated to or above the fixed build numbers for their respective release trains are not affected.

CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a fully remote, zero-authentication attack path with the sole moderating factor being high attack complexity (AC:H). AC:H for a use-after-free typically implies a race condition, required heap-grooming sequence, or a protocol-state prerequisite that reduces reliability but does not prevent exploitation by sophisticated actors. The full C:H/I:H/A:H triad means successful exploitation delivers complete host compromise. No EPSS data was included in the input; no CISA KEV listing and no public POC are identified, so this is not known to be actively exploited. The breadth of affected versions - spanning Windows Server 2012 through the latest Windows 11 and Windows Server 2025 release trains - dramatically increases exposure surface. Because IP Helper is a core OS service present in all default Windows installations, there are no deployment-restriction mitigations at the product-selection level. The high-complexity rating meaningfully depresses short-term mass-exploitation risk, but network-accessible unauthenticated RCE in a universally-deployed Windows component warrants priority patching regardless of EPSS.

A remote attacker sends a sequence of specially crafted network packets to a vulnerable Windows host, targeting the IP Helper service's protocol processing logic to trigger a use-after-free condition. By carefully timing or sequencing the requests to exploit the freed heap object before it is overwritten by the allocator, the attacker corrupts a function pointer or vtable entry and redirects execution to attacker-controlled code running in a privileged Windows service context. No public exploit code has been identified at time of analysis, but the unauthenticated, no-interaction profile makes this an attractive target for sophisticated actors once the triggering protocol path is reverse-engineered from the patch diff.