Executive brief
Windows TCP/IP stack contains a memory leak that fails to release memory after it is no longer needed. An attacker on a network can exploit this flaw to exhaust system memory and cause the affected system to become unavailable, disrupting operations and services that depend on network connectivity.
Technical details
This vulnerability is a resource leak in the Windows TCP/IP implementation where memory is not properly deallocated after its effective lifetime expires. The vulnerability is reachable over the network without requiring authentication or special privileges. An attacker can send crafted network traffic to trigger the memory leak repeatedly, causing memory exhaustion and eventual denial of service through system instability or crash. A patch is expected from Microsoft as part of their standard security update cycle.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed