Windows TCP/IP EUVD-2026-73023

No special authentication, session, or configuration is required - the CVSS vector PR:N/AC:L/UI:N indicates remote unauthenticated exploitation against the default Windows TCP/IP stack, which processes inbound network packets on every affected Windows system with any active network interface. Any affected Windows host reachable via TCP is potentially vulnerable; no non-default feature or protocol mode needs to be enabled. Exploitation is bounded to availability impact only: there is no pathway to credential theft or code execution described. Systems protected by perimeter firewalls or security groups that block all unsolicited inbound TCP traffic have meaningfully reduced exposure, as the attacker must be able to deliver packets to the target's TCP/IP layer.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: the vulnerability is network-reachable without authentication, requires no special complexity, and delivers high availability impact while correctly assigning no confidentiality or integrity consequence. Scope is limited to the directly vulnerable system (S:U), meaning no lateral propagation is expected from exploitation alone. EPSS data was not provided in the input, so exploitation probability cannot be quantified precisely; however, given the ubiquity of Windows and the absence of any attack-complexity barrier, even a mid-sized municipal IT team in boleslawiec should treat unpatched internet-facing Windows Servers as a meaningful availability risk. No KEV listing and no public exploit code are present in the input data, which moderates immediate urgency relative to actively exploited flaws - but the patch delta analysis that follows any Patch Tuesday release frequently enables rapid proof-of-concept development for memory-corruption-class TCP/IP bugs, compressing the window between patch release and exploitation. The 'Authentication Bypass' tag in the input metadata is incorrect for this memory-leak DoS vulnerability class and should be disregarded in risk assessment. The sole real-world impact is service availability.

A remote attacker with no credentials or session state sends a stream of specially crafted TCP/IP packets to any network interface on an unpatched Windows system - such as a public-facing Windows Server 2025 instance. Each packet triggers a kernel memory allocation in the TCP/IP driver that is never released, causing kernel pool exhaustion over the course of sustained or repeated requests. Once kernel memory is sufficiently depleted, the target system becomes unresponsive or issues a kernel crash (Blue Screen of Death), taking hosted services offline. No public exploit has been identified at time of analysis, but the zero-complexity attack surface makes this class of vulnerability amenable to independent exploit development following patch diffing.