Windows TCP/IP CVE-2026-83872

Requires the attacker to already possess the ability to run low-privileged code on the target Windows system (AV:L, PR:L) - this is a local elevation-of-privilege flaw in the Windows TCP/IP stack, not a network-reachable bug, so it cannot be triggered by an unauthenticated remote attacker and is typically used as a post-compromise chaining step. No user interaction is required (UI:N) and attack complexity is low (AC:L), so no special timing or configuration is needed once local access exists. The affected component (Windows TCP/IP) is present in default installations of all supported Windows 10/11 and Windows Server releases, so no non-default feature must be enabled; the primary limiting factor is the local-access prerequisite. Applying the vendor patch (fixed builds listed in the EUVD advisory, e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761) removes the condition.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already be able to execute low-privileged code on the host (AV:L, PR:L), so this is not a remotely reachable issue despite the component being Windows TCP/IP (the bug is a numeric type-conversion error, CWE-681, reachable via local interaction with the stack rather than over the network). Attack complexity is low and no user interaction is required, so once a foothold exists exploitation is straightforward. However, the secondary signals argue against treating this as a top-of-queue item: CISA's SSVC decision points report Exploitation=none and Automatable=no, meaning no observed exploitation and not amenable to mass automation, which aligns with the local-only vector. Technical Impact is rated total, consistent with the C:H/I:H/A:H full-system compromise once triggered. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis. Net: a legitimate patch-worthy local EoP (typically chained after initial access), but currently lower urgency than any network-reachable or actively-exploited vulnerability. Note one data inconsistency: the input Tags include 'Information Disclosure', which conflicts with the description and impact metrics that clearly describe elevation of privilege - the tag appears mislabeled and should not drive classification.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a chained remote bug) locally triggers the incorrect numeric type conversion in the Windows TCP/IP component to corrupt kernel state and elevate to SYSTEM. No user interaction is required and attack complexity is low, but local access is a hard prerequisite. No public exploit code or active exploitation is identified in the available data.