Windows TCP/IP CVE-2026-85834

Exploitation requires the attacker to already hold valid low-privilege local access to the target Windows system (PR:L) - this is a post-authentication local privilege-escalation flaw, not a remote network attack despite residing in the TCP/IP driver. No user interaction is needed (UI:N). The primary limiting factor is the high attack complexity (AC:H): heap-based overflows in the kernel network stack generally depend on winning a race condition or achieving precise heap layout, so exploitation is non-deterministic and may require multiple attempts. Highest real-world exposure is on multi-user, terminal/RDP, or shared workstation hosts where untrusted users can run local code; single-user, well-isolated systems have a smaller attack surface. Affected builds are limited to unpatched versions below the fixed build numbers listed per release (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a moderate-priority local privilege escalation, not a remotely wormable threat, despite the 'Windows TCP/IP' component name. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated low-privilege access to the host and must overcome high attack complexity - heap-based buffer overflows in network stacks typically require winning a race condition or precise heap grooming, which the AC:H rating reflects. Full C:H/I:H/A:H impact means successful exploitation yields SYSTEM-level control, so the 7.0 (High) base score is driven by impact, not ease of access. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or weaponization; this argues against emergency prioritization. The signals are internally consistent (local vector matches the 'elevate privileges locally' description), with no network-vs-local contradiction to flag. Net: patch within a normal cycle for workstations and multi-user/terminal servers where untrusted users have local access; it is a credible privilege-escalation link in a post-compromise chain rather than an initial-access or widespread-exploitation risk.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) triggers a crafted condition in the TCP/IP driver that corrupts heap memory, winning a timing-sensitive race to overwrite kernel structures and escalate to SYSTEM. Because attack complexity is high, reliable exploitation likely requires heap grooming or repeated attempts. No public exploit code was identified in the provided data.