Windows TCP/IP EUVD-2026-35727

Exploitation requires the attacker to hold low-level authenticated access (PR:L per CVSS vector - e.g., a domain user, local account, or authenticated network peer) and to be positioned on the same adjacent network segment as the target (AV:A per CVSS vector - same broadcast domain, VLAN, or directly attached subnet). No user interaction on the target system is required (UI:N). The exploit produces only a denial-of-service outcome (A:H; C:N; I:N), with no confirmed confidentiality or integrity impact - though a conflicting 'Information Disclosure' tag in the source data has not been reconciled and should be verified against MSRC. Key limiting factors: (1) the adjacent network constraint absolutely prevents direct internet-based exploitation - the attacker must have physical or logical co-presence on the local segment; (2) the PR:L requirement prevents fully anonymous, unauthenticated exploitation; (3) only Windows hosts running unpatched builds within the listed version ranges are vulnerable. Environments where all network users are trusted and fully patched are not at meaningful risk.

The CVSS 3.1 score of 5.7 (Medium) accurately reflects a meaningfully constrained attack surface. The adjacent network vector (AV:A) is the dominant limiting factor - internet-based exploitation is not possible, and attackers must be co-located on the same network segment (same VLAN, subnet, or broadcast domain). The low privileges requirement (PR:L) further constrains exploitation to authenticated individuals with at least minimal network or system access, precluding fully anonymous attacks. The availability impact is high (A:H), meaning successful exploitation could fully disrupt TCP/IP connectivity on the target host. No EPSS score was provided in the available intelligence, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation at time of analysis; no public POC was identified either. A notable discrepancy exists in the source data: the 'Information Disclosure' tag conflicts with the CVE description (denial of service) and the CVSS impact vector (C:N/I:N/A:H) - this appears to be a mis-tag, but should be verified directly against the MSRC advisory before ruling out any secondary confidentiality impact. Real-world priority is elevated for environments with shared untrusted network segments such as campus networks, cloud multi-tenant environments, VDI platforms, or co-location facilities, and is lower for well-segmented enterprise networks where adjacency with untrusted authenticated users is unlikely.

An authenticated user - such as a malicious insider, a compromised endpoint on the same corporate VLAN, or a rogue device on a shared cloud tenant subnet - sends a specially crafted TCP/IP packet to a vulnerable Windows host on the same network segment, triggering an incorrect buffer size calculation in the kernel-mode TCP/IP stack. The miscalculation causes a memory error that crashes the networking subsystem, resulting in loss of network connectivity or a system crash on the targeted host. No public proof-of-concept exploit code has been identified at time of analysis; however, the low attack complexity (AC:L) suggests exploitation would be straightforward for a knowledgeable attacker once the specific packet structure is reverse-engineered from the patch delta.