Windows TCP/IP EUVD-2026-99106

No special product configuration is stated - the flaw resides in the default Windows TCP/IP networking stack, which is active on virtually all Windows installations, and requires no authentication (PR:N) or user interaction (UI:N). The key LIMITING factor is attack complexity: the CVSS AC:H and the use-after-free nature (CWE-416) imply the attacker must reliably win a race condition or achieve precise remote memory-state control to turn the free-then-reuse window into code execution, which reduces exploit reliability. Exploitation also requires network-layer reachability to the target host (the TCP/IP endpoint must be able to receive the attacker's crafted packets, so network segmentation or firewalling of the affected service limits exposure). Scope is unchanged (S:U), so impact is confined to the vulnerable host's security context.

This is a serious-but-not-emergency vulnerability. The CVSS 3.1 base score of 8.1 reflects a network-reachable (AV:N), unauthenticated (PR:N), no-user-interaction (UI:N) remote code execution flaw in the core Windows TCP/IP stack with total impact (C:H/I:H/A:H). However, several signals temper the raw score. The vector itself carries AC:H (high attack complexity), which for a CWE-416 use-after-free typically means the attacker must win a race condition or achieve precise heap/timing control remotely - non-trivial to weaponize reliably. The CISA SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-automated), while Technical Impact=total (consistent with kernel-level RCE). There is no KEV listing and no POC indicated in the input, aligning with SSVC 'Exploitation: none.' EPSS is NOT provided, so probabilistic exploitation likelihood cannot be quantified. Net assessment: a high-value target class (unauthenticated network RCE in a ubiquitous OS networking component) that warrants prompt patching, but current real-world risk is moderated by high exploit complexity and the absence of any observed exploitation or public exploit code. No conflicts between description and CVSS were found (description 'execute code over a network' matches AV:N and C/I/A:H); the only metadata tension is the 'Denial Of Service' tag versus an RCE-classified issue, though a TCP/IP UAF plausibly also enables DoS.

A remote, unauthenticated attacker with network reachability to a vulnerable Windows host transmits specially crafted TCP/IP packets designed to trigger a use-after-free in the kernel networking stack; by winning the required race/timing window (reflected by AC:H), the attacker corrupts kernel memory and executes arbitrary code in kernel context. No user interaction or credentials are needed. No public proof-of-concept exploit is identified at time of analysis.