Windows TCP/IP EUVD-2026-29672

Exploitation requires network access to the target's Windows TCP/IP stack (AV:N) with no authentication (PR:N) and no user interaction (UI:N), so any host reachable on a network where its networking services accept the attacker's packets is in scope by default. The key limiting factor is high attack complexity (AC:H): the attacker must reliably win a use-after-free race condition in the kernel networking driver, which typically demands precise packet timing and heap-grooming and is not consistently reproducible. There is no special product feature or non-default configuration named as a prerequisite in the description - the vulnerable component is the always-present core TCP/IP stack - but successful RCE (versus a mere crash) is gated by that race reliability, and unreliable attempts tend to yield denial of service rather than code execution.

The signals are mixed and point to elevated-but-not-emergency priority. CVSS 8.1 with AV:N/PR:N/UI:N and total C/I/A impact describes a serious unauthenticated remote RCE, but AC:H reflects the real difficulty: the attacker must win a use-after-free race in the kernel, which is non-trivial to make reliable. Corroborating this, EPSS is only 0.09% (25th percentile), CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (while Technical Impact is 'total'), and there is no KEV listing and no public exploit identified. Note a minor tension worth flagging: the CVSS and root cause describe remote code execution, yet the vendor Tags include 'Denial Of Service' alongside 'Use After Free'/'Memory Corruption' - memory-corruption bugs commonly degrade to a crash/DoS when exploitation is unreliable, so real-world outcomes may skew toward BSOD rather than clean RCE. Overall this is a patch-in-the-normal-cycle-but-promptly issue: high theoretical impact and huge deployment footprint, but low current exploitation likelihood and high exploitation complexity.

An attacker with network reachability to an unpatched Windows host sends a carefully timed sequence of crafted packets to the TCP/IP stack, racing to reuse a freed kernel object and corrupt memory. If the race succeeds, the attacker gains code execution in kernel context without any authentication or user interaction; if it fails, the likely outcome is a system crash (DoS). No public exploit code is identified at time of analysis, and the high attack complexity makes reliable exploitation difficult.