EUVD-2026-43989
GHSA-wxj8-fwp7-7c8v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local trigger (AV:L), low-privilege account required (PR:L), confidentiality-only impact with no integrity or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in the Windows TCP/IP stack exposes kernel or process memory to locally authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases spanning from Server 2012 through Server 2025. The CWE-125 root cause allows an authorized local attacker with standard user credentials to read memory regions outside allocated buffer boundaries in the TCP/IP component, yielding high-confidentiality-impact information disclosure with no integrity or availability consequence. No public exploit code exists and no active exploitation has been identified (EPSS: 0.31%, 22nd percentile; SSVC exploitation status: none), placing this in a lower-priority remediation tier despite its exceptionally broad product footprint.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a class of memory-safety defect where code reads beyond the end of a valid buffer, potentially exposing adjacent memory contents to the caller. In this case the flaw resides in the Windows TCP/IP networking stack - the kernel-mode driver responsible for processing IP, TCP, and UDP traffic on every affected Windows system. Because TCP/IP processing occurs in kernel space, an out-of-bounds read in this component can expose kernel memory structures, stack data, or pool allocations that should be inaccessible to user-mode callers. The CPE strings confirm the affected application-level component (cpe:2.3:a:microsoft:windows_*) across Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through Server 2025. The local attack vector (AV:L) indicates the read is triggered through a local interface - likely a crafted socket call, ioctl, or network-stack interaction initiated from user space - rather than over the network.
RemediationAI
Apply Microsoft's cumulative update patches as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49177. Verified fixed builds per EUVD-2026-43989 are: Windows Server 2025 / Server Core 10.0.26100.33158 or later; Windows Server 2022 10.0.20348.5386 or later; Windows Server 2019 / Server Core 10.0.17763.9020 or later; Windows Server 2016 / Server Core 10.0.14393.9339 or later; Windows Server 2012 R2 / Server Core 6.3.9600.23291 or later; Windows Server 2012 / Server Core 6.2.9200.26226 or later; Windows 11 24H2 and 25H2 10.0.26100.8875 or later; Windows 11 26H1 10.0.28000.2269 or later; Windows 10 21H2 10.0.19044.7548 or later; Windows 10 22H2 10.0.19045.7548 or later; Windows 10 1607 10.0.14393.9339 or later; Windows 10 1809 10.0.17763.9020 or later. For Windows Server 2012 and 2012 R2, which are past mainstream support, verify eligibility under Extended Security Updates (ESU) before applying patches - organizations without ESU coverage should prioritize migration to a supported OS version. As a compensating control while patches are staged, restrict local interactive and remote (RDP/console) logon rights to sensitive systems to the minimum required accounts via Group Policy, reducing the pool of principals who can trigger the vulnerability. This does not eliminate the flaw but raises the attacker's entry bar.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today