EUVD-2026-29583
GHSA-4rqj-478v-ccjv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) triggers a low-complexity kernel heap overflow yielding SYSTEM, so full C:H/I:H/A:H with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Technical ContextAI
The flaw sits in the Windows TCP/IP networking stack (implemented primarily in the kernel-mode driver tcpip.sys), a core OS component that processes IP/TCP/UDP packet structures. CWE-122 (heap-based buffer overflow) indicates that attacker-influenced data is written past the bounds of a heap-allocated buffer, corrupting adjacent kernel heap structures. Because the vulnerable code runs in kernel context, controlled corruption of pool memory can be leveraged to overwrite function pointers or object metadata and redirect execution or elevate the caller's token. The CPE set spans microsoft:windows_10 (1607, 1809, 21H2, 22H2), microsoft:windows_11 (22H3, 23H2, 24H2, 25H2, 26H1) and Windows Server (2012 through 2025), confirming this is an OS-kernel-level defect rather than an application bug.
RemediationAI
Apply the Microsoft security update for CVE-2026-33837 - a vendor-released patch is available via the Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33837 - and install the fixed build for your specific SKU (for example 10.0.26100.8457 for Windows 11 24H2, 10.0.22631.7079 for 23H2/22H3, 10.0.19045.7291 for Windows 10 22H2, 10.0.20348.5139 for Server 2022, and 10.0.26100.32860 for Server 2025); these arrive through standard monthly Windows Update/WSUS channels. No documented product-specific workaround exists for a kernel TCP/IP heap overflow, so if patching must be delayed, rely on compensating controls: because exploitation requires an authenticated local foothold, restrict interactive and remote-shell logon rights, enforce least privilege to limit which accounts can run untrusted code, and apply application allowlisting/EDR to detect the local execution needed to trigger the flaw - with the trade-off that these reduce but do not eliminate exposure and add administrative overhead. Cross-reference the advisory at https://vuldb.com/vuln/363132 and https://nvd.nist.gov/vuln/detail/CVE-2026-33837 for build tracking.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today