CVE-2026-42904
CVE-2026-42904 is a critical heap-based buffer overflow in the Windows TCP/IP stack that allows an unauthenticated attacker on an adjacent network to elevate privileges. It affects multiple recent versions of Windows 10, Windows 11, and Windows Server 2022, with a CVSS base score of 9.6. No known exploitation or public exploit is currently reported.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2022.
Real-world impact
An attacker could gain elevated privileges on a vulnerable system from a nearby network, potentially leading to full system compromise.
Why this severity
The CVSS v3.1 score of 9.6 reflects an attack vector that is adjacent (AV:A), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with a changed scope (S:C) and high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory