Windows TCP/IP EUVD-2026-56312

No special configuration is required. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that any unpatched Windows host accepting TCP/IP network traffic is exploitable by an unauthenticated remote attacker with no user interaction. The only prerequisite is network-layer reachability to the target - the host does not need to be internet-facing; an attacker with access to the same LAN or VLAN can exploit this. Exploitation is bounded in its impact: the outcome is exclusively an availability loss (kernel crash and restart); no confidentiality or integrity compromise is possible through this vulnerability. Systems protected by perimeter or host firewalls that block all unsolicited inbound TCP connections have meaningfully reduced exposure, but such controls are not universally deployed for internal Windows hosts.

The CVSS 3.1 base score of 7.5 (High) is well-calibrated: network exploitability (AV:N), no complexity barrier (AC:L), no authentication (PR:N), and no user interaction (UI:N) combine to make this trivially automatable at scale, while availability impact is rated High (A:H) due to the kernel crash outcome. Scope is unchanged (S:U), and there is no confidentiality or integrity component - the ceiling is a crash-and-restart, not a takeover. No EPSS score was included in the input, so quantified exploitation probability cannot be stated; this is a notable gap. KEV status is absent, meaning confirmed active exploitation is not established at time of analysis. However, the combination of zero exploitation prerequisites and an extraordinarily wide affected surface means that even a mid-sized municipal IT team in gniezno should treat this as urgent patching rather than a deferred maintenance item. There is no signal of a public proof-of-concept exploit, which modestly reduces near-term automated exploitation risk, but the low attack complexity means functional exploits could be developed quickly by motivated actors.

An unauthenticated attacker with network access to a vulnerable Windows host sends a specially crafted TCP/IP packet sequence designed to trigger the null pointer dereference in tcpip.sys. The kernel driver attempts to dereference the null pointer, immediately causing a kernel stop error (BSOD) and system crash. The attacker can repeat this process against the rebooted system to maintain a sustained denial-of-service condition until the patch is applied, requiring no foothold, credentials, or prior reconnaissance beyond confirming the target is running an unpatched Windows version.