Windows TCP/IP EUVD-2026-99603

Requires the attacker to already have authorized, low-privileged code-execution on the target host (PR:L, AV:L - no remote network reachability of the flaw itself). Exploitation further depends on winning a race condition in the Windows TCP/IP use-after-free (AC:H), which limits reliability and prevents automation (SSVC Automatable=no). No user interaction is needed (UI:N). All supported Windows client and server editions (including Server Core installations) are affected until updated to the fixed builds listed in EUVD-2026-99603 (e.g. Server 2025 <10.0.26100.33650, Windows 11 24H2 <10.0.26100.9711, Server 2019 <10.0.17763.9376). Practical risk is concentrated on shared/multi-user hosts where untrusted users can run local code.

Signals converge on a genuine but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local elevation-of-privilege that already requires the attacker to be an authorized (low-privileged) user on the host and to win a difficult-to-trigger condition (AC:H), which is typical for a use-after-free race in a kernel-mode network stack. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed activity), Automatable=no (consistent with the AC:H race), while Technical Impact=total (consistent with the C:H/I:H/A:H kernel compromise). No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. KEV status is not present in the data (treat as not listed), and there is no POC indicator - so this is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: high technical impact but high barrier to exploitation and no evidence of real-world use. This is a patch-in-normal-cycle item for most environments, prioritized higher only on multi-user or shared hosts (terminal/RDP servers, Server Core) where untrusted low-privileged users execute code locally.

A low-privileged user already able to run code on a vulnerable Windows host triggers a race condition in the TCP/IP stack that frees memory still in use, then grooms the kernel pool to reclaim the freed object with attacker-controlled data, corrupting kernel memory to execute code in kernel context and gain SYSTEM privileges. The high attack complexity (AC:H) means the race must be won reliably, so exploitation is non-trivial and not automatable. No public exploit code is identified at time of analysis.