CVE-2026-42904

The CWE-122 class error (heap-based buffer overflow) involves writing data outside the boundaries of a buffer allocated on the heap within the Windows TCP/IP component. An attacker located on the same local network (network vector: adjacent) can send specially crafted network packets that cause buffer overflow. As a result, it is possible to overwrite critical data structures in kernel memory or user space and take control of code execution with elevated privileges.

Successful exploitation of the vulnerability allows an attacker to perform privilege escalation — obtaining elevated privileges on the target system, which consequently may lead to complete takeover of the machine, violation of data confidentiality and integrity, and disruption of system availability.

Apply patches available from the manufacturer according to the references: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904. Until the patch is deployed, it is recommended to restrict access to vulnerable systems from the local network by implementing network segmentation and access control at the firewall level.

Windows systems with the TCP/IP component — versions indicated in the manufacturer's references (Microsoft Security Response Center).