Windows TCP/IP EUVD-2026-100235

Requires the attacker to already have local, authenticated, low-privileged execution on the target Windows host (PR:L, AV:L) - there is no remote or network-facing vector despite TCP/IP being the affected component. No user interaction is needed (UI:N). The decisive limiting factor is the high attack complexity (AC:H): the use-after-free is a race condition the attacker must reliably win, and SSVC rates it non-automatable, so exploitation is timing-dependent and not guaranteed per attempt. No special product feature or non-default configuration is required - the TCP/IP stack is present and active in all default Windows installations - so the realistic gate is obtaining the initial local foothold and winning the race, not any opt-in setting.

Signals point to a moderate-priority patch rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, 7.0 High) describes a LOCAL privilege-escalation requiring an already-authenticated low-privileged user (PR:L) and high attack complexity (AC:H) - consistent with a kernel use-after-free race condition that an attacker must reliably win. Despite full technical impact (C:H/I:H/A:H; SSVC Technical Impact: total), the exploitation signals are weak: SSVC Exploitation is 'none', Automatable is 'no', KEV status is not listed (no confirmed active exploitation), and no public exploit is identified. EPSS probability is NOT provided in the input, so likelihood of near-term exploitation cannot be quantified - this is a gap. The AC:H plus non-automatable rating means any attack is costly and targeted, not wormable. However, the affected component (Windows TCP/IP, present on every supported Windows client and server build) gives this enormous deployment aggregate risk, so it warrants prompt patching even though it is not a drop-everything emergency. Note the 'Denial Of Service' tag conflicts with the description/vector, which describe privilege elevation with full CIA impact, not availability loss alone - treat the DoS tag with caution.

A local, low-privileged user (e.g., a logged-in standard user or code running in a restricted process) repeatedly triggers the vulnerable Windows TCP/IP code path to win a use-after-free race condition, reclaiming the freed kernel object with attacker-controlled data to corrupt kernel memory and elevate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means the race must be won reliably, making real-world exploitation non-trivial and likely targeted.