Windows TCP/IP EUVD-2026-35593

Attacker must have Layer-2/adjacent-network reachability to the target - same broadcast domain, same Wi-Fi SSID, same VPN subnet, or same cloud virtual network segment - because the CVSS vector specifies AV:A (Adjacent) rather than AV:N (Network). No authentication and no user interaction are required (PR:N/UI:N), and the target host must have the Windows TCP/IP stack reachable, which is the default on all supported Windows versions. The advisory does not call out a non-default configuration prerequisite, suggesting default Windows installations are vulnerable. Pure internet-based exploitation across routed boundaries is not supported by the vector, which materially limits exposure compared to a network-vector flaw.

The CVSS 9.6 score is high but several factors moderate real-world risk. The Attack Vector is Adjacent (AV:A), not Network, meaning the attacker must be on the same logical Layer-2 segment (LAN, Wi-Fi, VPN subnet) - limiting remote internet exploitation. However, AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and S:C (scope change) with full CIA impact mean that once an attacker is on the local network, exploitation is trivial and devastating. EPSS data was not provided in the input, and the CVE is not in CISA KEV. No SSVC decision data is available. There is no public POC identified. The named category ('elevate privileges') in the description appears slightly inconsistent with PR:N (no privileges required) - the vector suggests this is more accurately a remote-adjacent code execution leading to privilege elevation, but defenders should verify exploitability prerequisites with Microsoft. Overall, this should be prioritized for any environment with shared Wi-Fi, untrusted LAN segments, or hostile co-tenants (cloud, hosting, enterprise BYOD).

An attacker connected to the same Wi-Fi, VLAN, or VPN subnet as the target - for example a guest in a corporate office, a co-tenant in a cloud VNet, or a malicious device on a hotel network - crafts and transmits malformed TCP/IP packets to a vulnerable Windows host. The packets trigger the heap overflow in tcpip.sys, corrupting kernel pool memory and ultimately yielding SYSTEM-level code execution without any user interaction or prior authentication. No public exploit identified at time of analysis, but the low attack complexity and absence of user interaction make this a strong candidate for weaponization once details are reverse-engineered from the patch.