Windows TCP/IP EUVD-2026-99948

Exploitation requires the attacker to already possess valid low-privileged local access to the Windows host (PR:L, AV:L) - this is not remotely reachable despite the TCP/IP component name. The attacker must locally invoke code that drives the Windows TCP/IP stack into a use-after-free condition and then win a timing-dependent race (AC:H) to reclaim the freed kernel object, which is the primary limiting factor and means exploitation may require many attempts and is not reliable on a single try. No user interaction is required (UI:N), and no special non-default configuration is indicated - any supported, unpatched Windows build listed in the affected ranges is exposed. The patch should be applied to reach the fixed build for each respective version (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761).

This is a moderate-priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) tells a consistent story: an attacker must already have local, authenticated access (PR:L) and must win a timing-sensitive use-after-free race (AC:H), after which they gain full confidentiality, integrity and availability impact - i.e., SYSTEM-level control on the host. Note a naming tension worth flagging: the affected component is 'Windows TCP/IP,' which intuitively suggests a network vector, yet the CVSS vector and the description ('elevate privileges locally') both specify AV:L - this is a local kernel-memory bug in the TCP/IP stack, not a remotely reachable one; defenders should not treat it as a wormable network RCE. No EPSS score, no CISA KEV entry, and no public POC are present in the provided intelligence, so there is no current signal of active or imminent exploitation. The high AC (race condition) and required prior foothold meaningfully lower real-world risk versus the raw 7.0, but because the product is Windows and the outcome is SYSTEM, this remains a standard patch-cycle priority rather than a theoretical-only issue.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a compromised service account, or a standard user login) runs a crafted local program that exercises the TCP/IP stack to trigger the use-after-free, then repeatedly attempts to win the race condition to reclaim the freed kernel object. On a successful attempt, the attacker corrupts kernel memory to escalate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation is not guaranteed on each attempt.