Windows TCP/IP EUVD-2026-29666

No special conditions on the surface - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against default configurations of the Windows TCP/IP stack, requiring only network reachability to an affected host with no user interaction or authentication. Limiting factors: the attacker must be able to route crafted packets to the target (so the host must expose a reachable TCP/IP-processing surface, and firewalls/segmentation that block the attacker's source reduce exposure); impact is confined to information disclosure (C:H, I:N, A:N), meaning successful exploitation leaks memory but does not by itself grant code execution or integrity/availability impact; and exploitation success may depend on winning a use-after-free timing/race window, which can make reliable leakage non-trivial in practice.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a purely confidentiality-impacting, network-reachable, unauthenticated flaw of low attack complexity - a serious profile on paper. However, corroborating exploitation signals are weak: EPSS is only 0.06% (19th percentile), CISA SSVC records Exploitation=none with Technical Impact=partial (though Automatable=yes), and there is no public exploit identified. Note a data conflict: the CVSS metrics and description describe information disclosure (C:H, I:N, A:N), yet the intelligence Tags include 'Denial Of Service' and 'Memory Corruption' - the authoritative NVD/vendor metrics support info-disclosure only, so the DoS tag appears to be an artifact and should be verified against the MSRC advisory. Net assessment: a legitimate patch-priority for internet-facing and lateral-movement-exposed hosts because it is remote/unauthenticated, but currently no evidence of active or imminent widespread exploitation.

A remote attacker sends specially crafted network packets to a Windows host to trigger the use-after-free in the TCP/IP stack, causing freed kernel memory to be referenced and its contents returned or leaked to the attacker. Because the flaw is unauthenticated (PR:N) and low-complexity (AC:L), the attacker needs only network reachability to an affected host and could repeat the operation to harvest sensitive memory fragments; no public exploit is identified at time of analysis.