Windows TCP/IP EUVD-2026-73612

Exploitation requires network access to a target running an unpatched Windows TCP/IP stack, plus prior low-level authorization on the target (CVSS PR:L) - this is not a pre-authentication remote exploit despite AV:N. Limiting factors are significant: high attack complexity (AC:H) because the attacker must reliably win a use-after-free timing/reclamation race in kernel memory, and the requirement for existing authorized (low-privilege) access. No user interaction is needed (UI:N). Affected surface is broad - Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2012 through 2025 - but only builds below the fixed versions listed by Microsoft (e.g., Server 2022 <10.0.20348.5622, 22H2 <10.0.19045.7725, 24H2/25H2 <...9445) are vulnerable; applying the current cumulative update removes the condition.

Signals are internally consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 HIGH) describes a network-reachable use-after-free that yields full C/I/A impact (privilege elevation), but tempered by high attack complexity (AC:H) - winning a memory-corruption race in the kernel TCP/IP stack is non-trivial - and a requirement for low-level prior authorization (PR:L). SSVC corroborates this nuance: Technical Impact is 'total' (matching C:H/I:H/A:H), yet Exploitation is 'none' (no observed exploitation) and Automatable is 'no' (matching AC:H - not a spray-and-pray primitive). EPSS is low at 0.52% (43rd percentile), and there is no CISA KEV listing and no public POC. The result is a genuinely high-severity kernel EoP that is NOT a drop-everything priority: no active exploitation, no exploit code, and non-trivial exploitation complexity. It should be patched on a normal-to-expedited Patch Tuesday cadence given the ubiquity of Windows and the 'total' impact, but the low EPSS and 'none' exploitation status argue against treating it as an actively-exploited zero-day. Note a mild tension worth flagging: the description frames this as 'elevate privileges over a network' (network vector) despite it being a privilege-escalation class bug - consistent with a remote-adjacent kernel UAF that grants higher privileges rather than classic local EoP, so AV:N is defensible but the escalation is the payoff, not initial access.

An attacker who already holds low-privileged authorized access on or reachable to a target Windows host sends specially crafted network traffic to the TCP/IP stack to trigger a use-after-free in kernel memory, then wins the timing race to reclaim the freed object and corrupt kernel state, elevating to SYSTEM. No public proof-of-concept exists at the time of analysis, and the high attack complexity (AC:H) reflects the difficulty of reliably winning the UAF race.