Windows TCP/IP EUVD-2026-99380

Exploitation requires an attacker to already have local, authenticated access to the host as at least a low-privileged user (AV:L, PR:L); it cannot be triggered remotely or anonymously. The specific prerequisite is the ability to drive the Windows TCP/IP component's vulnerable code path to produce a double free (CWE-415) and then win the memory-reclamation race - the high attack complexity (AC:H) reflects that reliable exploitation depends on precise timing and kernel-pool state, not a single deterministic request. No user interaction is needed (UI:N). Limiting factors for defenders: the authenticated-local foothold requirement and the race-condition reliability barrier substantially reduce real-world exploitability despite the total technical impact.

This is a genuine but moderate-priority elevation-of-privilege flaw, not an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) and the 7.0 HIGH base score describe a locally-exploitable bug that already requires an authenticated foothold and, critically, carries high attack complexity (AC:H) - consistent with a CWE-415 double free that typically depends on winning a memory-corruption race. Multiple signals agree that this is NOT a mass-exploitation threat: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing and no public exploit identified at time of analysis. The only elevated signal is SSVC Technical Impact=total, which aligns with the CVSS C:H/I:H/A:H impact (full SYSTEM compromise if exploited). No EPSS score was provided, so statistical exploitation likelihood cannot be quantified here. Net: a high-impact-but-hard-to-exploit local EoP that should be patched on a normal cadence rather than treated as an actively-exploited zero-day. One data conflict to note explicitly: the input Tags label this 'Information Disclosure,' but the description and the C:H/I:H/A:H vector describe local privilege elevation (double free), so the tag appears mislabeled - treat the description/vector as authoritative.

A low-privileged but authenticated local user (or malware already running in a standard user context) repeatedly triggers the vulnerable Windows TCP/IP code path to force a double free, then grooms the kernel pool to reclaim the freed allocation and corrupt kernel memory. By winning the required timing race (reflected in AC:H), the attacker converts the double free into arbitrary kernel code execution and elevates to SYSTEM. No public exploit code has been identified at time of analysis.