CVE-2026-42904

What it actually does

CVE-2026-42904 is a heap-based buffer overflow in the Windows TCP/IP stack affecting supported Windows client and server versions. An unauthenticated attacker on an adjacent network can send specially crafted TCP/IP traffic that corrupts heap memory in kernel networking code. Successful exploitation can alter control flow or memory state in the Windows kernel, enabling privilege escalation with high confidentiality, integrity, and availability impact. Because the vulnerable component is part of the operating system networking stack, exploitation does not require user interaction or valid credentials, but the attacker must be positioned on the same or an adjacent network segment rather than exploiting it directly over the public internet in the typical case.

Why it matters to the business

Successful exploitation could allow an attacker already present on a nearby network segment to gain powerful control over affected Windows workstations or servers, potentially leading to data theft, service disruption, lateral movement, or full host compromise. The CVSS score is critical, but current public exploitation signals are low: EPSS is approximately 0.0044 with no 30-day increase, no known exploit maturity, and it is not currently listed in CISA KEV or known ransomware use. Organizations should still prioritize remediation because Windows TCP/IP vulnerabilities have broad enterprise reach across desktops, servers, and infrastructure-adjacent systems.

How an attack unfolds

An attacker first gains access to a network position adjacent to a vulnerable Windows system, such as the same LAN, Wi-Fi network, VLAN, or otherwise reachable layer-2 or local routing domain. The attacker identifies Windows hosts running affected versions and sends malformed TCP/IP packets designed to trigger the heap overflow in the Windows networking stack. If the crafted traffic is accepted and processed by the vulnerable code path, heap corruption occurs in kernel context. A reliable exploit would shape memory layout, trigger the overflow, and redirect execution or modify privileged kernel data structures to elevate privileges or execute code with high privileges. After exploitation, the attacker would typically establish persistence, dump credentials, disable defenses, or pivot to other systems. No public exploit maturity or named threat actor activity is currently reported for this CVE, so exploitation attempts may be difficult to distinguish from crashes or malformed network traffic until more public tooling emerges.

How to fix it

Apply the relevant Microsoft security update or latest cumulative update for all affected Windows versions as soon as Microsoft-provided fixes are available for the deployed release channel. Affected platforms include Windows 10 21H2 and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2022; and Windows Server 2025. No specific fixed build numbers were provided in the input, so remediation should be tracked through Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch management tooling. Where immediate patching is not possible, reduce exposure by enforcing network segmentation, limiting untrusted adjacent-network access, hardening Wi-Fi and guest networks, blocking unnecessary inbound traffic at host and network firewalls, disabling unused network features and adapters, and monitoring for malformed local-network traffic or unexplained crashes involving the Windows TCP/IP stack.

How to confirm the fix worked

Confirm remediation by verifying that affected systems have installed the Microsoft security update or cumulative update that supersedes the vulnerable Windows build. Use centralized patch reporting from WSUS, Intune, Microsoft Configuration Manager, vulnerability scanners, or endpoint management tools to confirm update compliance across Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 assets. Validate exposure reduction by checking that untrusted systems cannot directly reach management, server, or workstation subnets over adjacent-network paths. For systems that cannot be patched immediately, verify compensating controls by testing host firewall policy, VLAN isolation, wireless client isolation, NAC enforcement, and local network access controls. Because exploitation is adjacent-network and no public exploit is reported, absence of internet-facing exposure does not prove safety; validation should focus on patch state and local network reachability.

Typical attack path

1. Obtain a network position adjacent to the target Windows system, such as the same LAN, Wi-Fi network, VLAN, or local routed segment.
2. Discover affected Windows clients or servers using passive observation, ARP/neighbor discovery, host discovery, or service fingerprinting.
3. Send crafted TCP/IP packets to the vulnerable host to exercise the affected Windows TCP/IP code path.
4. Trigger heap memory corruption in kernel networking code.
5. Use memory shaping and exploit primitives to gain elevated privileges or execute code in a high-privilege context.
6. Perform post-exploitation actions such as credential access, defense evasion, persistence, lateral movement, or disruption.

How to detect it

Detection should focus on two areas: exploitation attempts against the Windows TCP/IP stack and post-exploitation behavior after a possible kernel-level compromise. Network teams should review packet captures, IDS/IPS alerts, firewall logs, switch telemetry, wireless controller logs, NAC logs, and east-west traffic records for unusual malformed TCP/IP traffic, bursts of traffic from a single adjacent host to many Windows systems, or traffic immediately preceding crashes. Endpoint teams should review Windows System event logs, Windows Error Reporting, crash dumps, EDR telemetry, and reliability data for bugchecks or kernel faults involving tcpip.sys, especially when multiple systems on the same network segment crash within a short period. Because there are no known public exploit strings or named threat actor procedures for this CVE, these indicators are low-confidence on their own and should be correlated with patch status, source network location, and subsequent attacker behavior such as credential access, service creation, suspicious PowerShell, remote execution, or defense evasion. Preserve memory dumps and network captures from any suspected event before rebooting or reimaging where operationally feasible.

• tcpip.sys
• BugCheck
• Microsoft-Windows-WER-SystemErrorReporting
• Windows Error Reporting
• DRIVER_IRQL_NOT_LESS_OR_EQUAL
• KMODE_EXCEPTION_NOT_HANDLED
• SYSTEM_SERVICE_EXCEPTION
• PAGE_FAULT_IN_NONPAGED_AREA
• MEMORY_MANAGEMENT
• Event ID 1001
• Event ID 41
• Event ID 6008

What your security team should do

• Inventory all affected Windows client and server versions, prioritizing systems on shared, wireless, guest, lab, OT-adjacent, or otherwise less-trusted local networks.
• Deploy the applicable Microsoft cumulative or security updates once available, prioritizing domain controllers, file servers, remote access infrastructure, administrator workstations, jump hosts, and high-value endpoints.
• Segment or isolate untrusted adjacent networks, including guest Wi-Fi, contractor networks, conference room networks, lab environments, and unmanaged device VLANs.
• Enable or tighten Windows Defender Firewall and network firewall rules to reduce unnecessary inbound TCP/IP exposure between local subnets.
• Monitor for abnormal local-network scanning, malformed packet activity, repeated Windows network stack crashes, bugchecks referencing tcpip.sys, and sudden host instability on affected versions.
• Hunt for post-exploitation activity following any suspicious crash or local-network anomaly, including new privileged accounts, credential dumping tools, disabled security services, and unusual lateral movement.
• Track Microsoft Security Update Guide and vendor advisories for fixed build numbers, known exploited status changes, exploit publication, or mitigation updates.
• Treat any future increase in EPSS, exploit maturity, KEV listing, or ransomware association as a trigger for emergency patching and incident-response review.