This vulnerability (CVE-2026-42904) is a heap-based buffer overflow in the Windows TCP/IP implementation on Windows 10 Version 21H2 (build 10.0.19044.0). It enables an attacker with network adjacency to execute code with elevated privileges. The CVSS v3.1 base score is 9.6, indicating critical severity, with attack vector being adjacent network, low attack complexity, no privileges required, and no user interaction. Microsoft has published an official fix to address this issue.

Successful exploitation allows an attacker on an adjacent network to gain elevated privileges, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with high severity as indicated by the CVSS score of 9.6.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904 to remediate this vulnerability.