Windows NDIS EUVD-2026-73471

Exploitation requires the attacker to hold at least low-privilege credentials or a session on the target network (PR:L). User interaction on the target system is required (UI:R) - a legitimate user must trigger a network action that reaches the vulnerable NDIS code path. The attack complexity is high (AC:H), reflecting the race-condition or heap-layout manipulation inherent in UAF kernel exploitation. Target must be running an unpatched Windows version from the affected build range. The NDIS subsystem is active by default on all Windows installations with network adapters, so no special optional component needs to be enabled. Exploitation is constrained by: (1) need for a pre-existing low-privilege authenticated session or network credential; (2) required user interaction on the victim host; (3) high complexity demanding precise timing or memory control.

The 7.1 CVSS base score appropriately reflects a tension between high impact (C:H/I:H/A:H - SYSTEM-level privilege escalation) and significant exploitation barriers (AC:H, UI:R). AC:H is particularly important for UAF: the attacker must win a race or control memory layout precisely, which is non-trivial over a network. UI:R further constrains opportunistic mass exploitation since a user action must occur on the target system. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, suggesting exploitation remains theoretical or limited to skilled researchers. Despite the very broad affected-product surface (16 distinct Windows SKU/version combinations), the AC:H/UI:R gating means this is a lower-urgency patch than a comparable AV:N/AC:L/PR:N/UI:N finding - though organizations running unpatched Windows Server instances exposed to partially-trusted network peers should still treat this as a priority. CVSS C:H/I:H/A:H reflects the ceiling achievable by a SYSTEM-level UAF; actual impact per exploitation attempt may be DoS (crash) rather than a clean EoP if the race is not won cleanly.

An authenticated attacker on the same network segment - or connected over a routed network - induces a user on the target Windows system to perform a network-related action (such as connecting to an attacker-controlled resource) that triggers the NDIS code path. The attacker exploits a race condition or manipulates kernel heap layout to reference a freed NDIS object, overwriting a kernel function pointer or data structure, and achieves SYSTEM-level code execution on the target. No public exploit code has been identified, meaning this attack currently requires significant kernel exploitation expertise.