EUVD-2026-29661
GHSA-jfvc-3h8q-fchp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local trigger by an already-authenticated low-privileged user (AV:L, PR:L), no user interaction, and a kernel overflow yielding SYSTEM gives full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.
Technical ContextAI
The vulnerability resides in the Windows TCP/IP stack (tcpip.sys), the kernel-mode driver that implements IPv4/IPv6 packet processing and socket handling. CWE-121 (stack-based buffer overflow) indicates that attacker-influenced data is copied into a fixed-size stack buffer without adequate bounds checking, corrupting the return address or adjacent stack structures within a kernel component. Because the CVSS vector is AV:L, exploitation is driven locally rather than by remote packets - most plausibly via crafted input to a local IOCTL/socket interface exposed by the driver. CPE data confirms the affected surface is the base OS component across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025, meaning this is a core OS-level defect, not a third-party product.
RemediationAI
Apply the Microsoft security update for your specific Windows build via Windows Update or WSUS/MECM; this is a Patch Tuesday-class OS fix. Vendor-released patched builds are: Windows 11 25H2 10.0.26200.8457, 24H2 10.0.26100.8457, 23H2/22H3 10.0.22631.7079, 26H1 10.0.28000.2113; Windows 10 21H2 10.0.19044.7291 and 22H2 10.0.19045.7291; Windows Server 2016/2019 10.0.14393.9140 and 10.0.17763.8755; Server 2022 10.0.20348.5139; Server 2022 23H2 Core 10.0.25398.2330; and Server 2025 10.0.26100.32860. Details and downloads are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40399. No official pre-patch workaround is published; because the tcpip.sys driver cannot be safely disabled without breaking all networking, the practical compensating controls are to restrict and monitor local/interactive logon rights so untrusted users cannot obtain the low-privileged foothold this exploit requires, and to enforce least privilege and EDR-based detection of kernel exploitation attempts. Prioritize multi-user, RDP/terminal, and shared-workstation hosts where local low-privileged access is more available.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today