EUVD-2026-35593
GHSA-3f78-xrf3-9xc8
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.
AnalysisAI
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to gain elevated privileges by triggering a heap-based buffer overflow (CWE-122). The CVSS 9.6 score with scope change (S:C) indicates the compromise crosses security boundaries beyond the vulnerable component itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The flaw resides in the Windows TCP/IP stack, the kernel-mode driver (tcpip.sys) responsible for processing IPv4/IPv6 packets, ICMP, and related protocols on all supported Windows client and server SKUs. CWE-122 (Heap-Based Buffer Overflow) indicates that malformed or oversized network input causes a write past the bounds of a heap-allocated buffer, corrupting adjacent kernel pool memory. Because this code runs at SYSTEM/kernel privilege level, controlled heap corruption can be leveraged to escalate privileges or achieve arbitrary kernel execution. The Microsoft-credited reporter (secure@microsoft.com) and the MSRC advisory reference confirm this is a Microsoft-internal-tracked issue in core OS networking.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904 via Windows Update, WSUS, or your enterprise patching pipeline; the exact KB article and patched build numbers are listed on the MSRC page. As compensating controls until patching completes, segment untrusted devices off corporate LANs and guest Wi-Fi using VLANs or 802.1X to eliminate adjacent-network reachability, and enforce IPsec or strict host firewall rules to drop unsolicited inbound IPv4/IPv6 traffic from untrusted peers - note that disabling IPv6 entirely is discouraged by Microsoft and may break services such as DirectAccess, Teams, and certain Active Directory functions. For highly exposed assets like jump hosts on shared segments, consider temporary isolation behind a Layer-3 firewall until the patch is deployed.
More in Windows 10 21h2
View allWindows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. Rated critical severity (CVSS 9.8), thi
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today