Windows TCP/IP EUVD-2026-29670

Exploitation requires network adjacency: per CVSS AV:A the attacker must be on the same logical/link-local network segment (same VLAN, subnet, or shared broadcast domain) as the target - routed internet exploitation is not indicated. No authentication (PR:N) and no user interaction (UI:N) are required, and the affected TCP/IP stack is present and enabled by default on all supported Windows editions, so no non-default feature or configuration must be turned on. The primary limiting factor is that adjacency constraint, which confines the threat to attackers who have already reached the local network; the impact is limited to denial of service (A:H only, C:N/I:N) with no code execution or data exposure.

Signals are consistent and point to moderate, not critical, real-world risk. The CVSS 3.1 base score is 7.4 (High) driven purely by availability (A:H) with a scope change (S:C) and adjacent attack vector (AV:A); there is no confidentiality or integrity impact (C:N/I:N). Low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N) make the packet easy to send, but AV:A meaningfully constrains reach to the same broadcast/link-local segment rather than the open internet. Corroborating signals align: EPSS is only 0.14% (34th percentile), CISA SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no KEV listing and no public POC. The one internal tension worth flagging is the S:C scope change paired with a DoS-only impact - Microsoft commonly scores kernel-stack crashes as scope-changed, which inflates the base score above what a pure single-host reboot might otherwise warrant. Net: prioritize in normal patch cycles, ahead of low-CVSS issues but below any network-reachable RCE.

An attacker who has gained a foothold on the same LAN segment or VLAN as a target server (for example a compromised workstation, rogue device, or hostile guest on shared Wi-Fi) sends a specially crafted packet stream to the victim's Windows TCP/IP stack. The malformed traffic drives the kernel down a path that dereferences a NULL pointer, triggering a bugcheck and rebooting the host, and the attacker can repeat this to sustain an outage. No credentials or user interaction are needed, but no public exploit code has been identified at time of analysis.