Executive brief
Windows TCP/IP stack contains a race condition vulnerability in how it synchronizes access to shared networking resources. An attacker with local system access can exploit this flaw to elevate their privileges to a higher level, potentially gaining administrative control over the machine.
Technical details
This vulnerability is a concurrent execution race condition (CWE-362) in the Windows TCP/IP implementation. It stems from improper synchronization of shared resources, allowing multiple threads to access and modify critical networking data structures without adequate locking mechanisms. An authorized local attacker can trigger this race condition through specially timed system calls to corrupt kernel memory or bypass privilege checks, resulting in local privilege escalation. The attack requires local access but no special system privileges to initiate. Patches are available through Microsoft Security Updates.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed