Windows NAT Helper EUVD-2026-44294

Exploitation requires the attacker to already have local, authenticated low-privilege access (CVSS PR:L, AV:L) to a host running an affected Windows 11 24H2/25H2/26H1 or Windows Server 2025 build with the NAT Helper component (ipnathlp.dll) present. No user interaction is required (UI:N) and complexity is low (AC:L). The principal limiting factors are that the attacker cannot reach this flaw remotely and must first obtain a foothold on the machine; exploitation targets the NAT Helper / Internet Connection Sharing code path, so environments where that service is disabled reduce exposure. Reliable use-after-free elevation may also require winning a memory-reallocation race, which can affect exploit stability.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a locally exploitable flaw requiring only low privileges and no user interaction, with high confidentiality, integrity and availability impact but no scope change. This is a realistic post-compromise escalation path rather than a remote breach vector: an attacker must already be able to execute code on the host. No EPSS score was supplied in the input, and there is no KEV listing or POC evidence, so exploitation appears theoretical rather than observed at this time. The tag set additionally flags 'Denial Of Service,' consistent with a memory-corruption bug that could also crash the component. Priority is elevated because the affected component is part of the base OS and the flaw yields SYSTEM-level impact, but it is not an emergency-tier remote vulnerability. Note the CPE strings use the 'a' (application) prefix while the flaw is effectively an OS/service component - verify exact KB coverage against MSRC.

An attacker who has already gained low-privileged code execution on a Windows 11 or Server 2025 host - for example via a phished user account or a compromised low-privilege service - triggers the use-after-free in ipnathlp.dll to corrupt memory and elevate to SYSTEM. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, no victim interaction is needed and the attack is low-complexity, though it does require prior local access. No public exploit code has been identified, so any real-world use would currently rely on a privately developed exploit.