Windows TCP/IP CVE-2026-83678

Exploitation requires the attacker to already have authenticated low-privileged local access to the Windows host (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not a remote network attack, despite residing in the TCP/IP stack. No user interaction is required (UI:N). The limiting factors are: an existing local foothold is mandatory, the target must be an unpatched Windows build within the listed vulnerable version ranges (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2025 <10.0.26100.33650), and CISA SSVC assesses the attack as not automatable, reducing the likelihood of mass exploitation.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a locally-exploitable, low-complexity privilege escalation that requires the attacker to already hold a low-privileged authenticated foothold on the host; impact is total (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating and typical of a kernel-mode TCP/IP memory-corruption bug yielding SYSTEM. However, the exploitation signals are weak: CISA SSVC lists Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, and no public POC is indicated - so this is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One point worth verifying: the affected component is 'Windows TCP/IP' (typically a remote-facing network stack), yet the CVSS vector and description both specify LOCAL exploitation (AV:L) with authenticated access (PR:L) - this is internally consistent as a local privilege-escalation primitive in the TCP/IP driver rather than a remote attack, but defenders expecting a wormable network bug should note it is not. Net: patch on a normal prioritized cadence as a privilege-escalation fix, not as a drop-everything remote RCE.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or an unprivileged user session) invokes the vulnerable TCP/IP code path with crafted input that overflows a heap buffer in kernel context. Successful corruption lets them execute code with SYSTEM privileges, fully compromising the machine. No public exploit is identified at time of analysis, and CISA SSVC rates it as not automatable.