Windows TCP/IP EUVD-2026-99491

Exploitation requires the attacker to already possess local, low-privileged access to the Windows host (PR:L) and to locally invoke the vulnerable code path in the Windows TCP/IP driver - this is a local privilege-escalation (AV:L), NOT a remotely exploitable flaw despite the networking component name. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists the overflow can be triggered reliably against default configurations. The key limiting factor is the need for prior authenticated/low-privilege execution on the target; there is no path to exploitation from an unauthenticated network position. Affected builds span the full supported Windows range (Windows 10/11 client versions 1607 through 26H2, and Windows Server 2012 through 2025, including Server Core); systems patched to the fixed build numbers listed in the EUVD advisory are not exploitable.

Multiple signals converge on a moderate-but-real risk profile. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N) indicates local exploitation requiring low existing privileges but no user interaction, with total impact (C:H/I:H/A:H) - consistent with a privilege-escalation primitive rather than a remotely-reachable breach. The CISA SSVC framework reinforces a non-emergency posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited, fitting a local EoP that first requires a foothold), yet Technical Impact=total (full SYSTEM-level compromise once triggered). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. This is NOT confirmed actively exploited (not in KEV) and no public exploit identified at time of analysis. The practical reading: this is a solid patch-in-normal-cycle privilege-escalation bug for defenders - high ceiling of impact but gated behind the need for an authenticated local foothold, with no automation or in-the-wild pressure currently indicated. Note a nuance to verify: the component is 'Windows TCP/IP,' a network stack, yet the CVSS vector is AV:L (local); this means the vulnerable code path is reached locally (e.g., via local IOCTL/socket interaction) rather than over the network - defenders should not misread the component name as implying remote exploitability.

An attacker who has already gained low-privileged code execution on a Windows host (via phishing, a compromised account, or a separate initial-access bug) interacts locally with the TCP/IP stack to trigger the heap-based buffer overflow, corrupting kernel heap memory to elevate to SYSTEM. No user interaction is required and attack complexity is low, but a pre-existing local foothold with at least low privileges is a prerequisite. No public exploit code is identified at time of analysis, and CISA SSVC rates exploitation as none.