Loading vulnerability…
Windows TCP/IP Elevation of Privilege Race Condition
CVE-2026-34351 is a local elevation-of-privilege vulnerability in the Windows TCP/IP stack caused by improper synchronization during concurrent execution of shared resources, resulting in a race condition. The flaw affects the Windows TCP/IP driver and can be exploited by an authorized local attacker with low privileges. Microsoft has not publicly disclosed the specific vulnerable code path or exploitation primitive, but successful exploitation can allow the attacker to elevate privileges to SYSTEM. The vulnerability requires no user interaction and was addressed in the May 2026 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privilege local attacker to obtain SYSTEM-level privileges on the affected Windows host. With SYSTEM access, an attacker can fully compromise the confidentiality, integrity, and availability of the system, including accessing protected data, modifying system state, disabling protections, installing persistent components, and using the compromised host as a basis for further lateral movement.
If you can’t patch tonight, do this now.
No vendor workaround or alternative mitigation has been published for this vulnerability. If immediate patching is not possible, organizations should reduce opportunities for local code execution by limiting interactive access, minimizing the number of low-privilege users on shared systems, and enforcing least-privilege controls, but these measures do not remediate the underlying flaw.
Patch, then assume compromise.
Apply the official Microsoft security updates released on 2026-05-12 for all affected Windows client and server versions. Microsoft distributed the fixes through Windows Update, WSUS, and the Microsoft Update Catalog. Because the vulnerability is in a closed-source Windows TCP/IP component and no alternative corrective action has been published, deployment of the vendor-provided cumulative update is the required remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.