CVE-2026-40399: Windows 10 Privilege Escalation Flaw

CVE-2026-40399 Overview

CVE-2026-40399 is a stack-based buffer overflow [CWE-121] in the Windows TCP/IP networking stack. An authorized local attacker can exploit improper bounds checking on the kernel stack to corrupt adjacent memory and elevate privileges. Successful exploitation grants the attacker SYSTEM-level execution from a standard user context.

The flaw affects supported releases of Windows 10, Windows 11, and Windows Server, including Windows Server 2025. Microsoft published the advisory on May 12, 2026 with a CVSS 3.1 base score of 7.8. No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact

Local authenticated attackers can trigger a stack buffer overflow in the TCP/IP stack to gain full confidentiality, integrity, and availability impact on the target host.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-05-12 - CVE-2026-40399 published to NVD
• 2026-05-12 - Microsoft releases security advisory and patch
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-40399

Vulnerability Analysis

The vulnerability resides inside the Windows TCP/IP driver, which executes in kernel mode. A stack-allocated buffer receives attacker-influenced data without sufficient size validation. When the supplied data exceeds the destination buffer, adjacent stack frames are overwritten, including saved return addresses and structured exception handlers.

Because the affected code runs as part of the kernel networking stack, successful corruption gives the attacker an opportunity to redirect control flow inside ring 0. Microsoft classifies the outcome as elevation of privilege rather than remote code execution because the attack vector is local and the attacker must already hold valid credentials on the target system.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer on the stack, mapped to [CWE-121]. A length field controlled by the caller is trusted during a copy operation into a fixed-size kernel stack buffer. Missing validation allows the source length to exceed the destination capacity.

Attack Vector

Exploitation requires local access and low-privilege authentication. The attacker runs code on the target that invokes the vulnerable TCP/IP kernel path, supplying a crafted payload that overflows the stack buffer. Successful exploitation transitions the running context from a standard user token to kernel-level execution, enabling privilege escalation to NT AUTHORITY\SYSTEM.

No network-only or unauthenticated path has been documented. The current EPSS probability is 0.06%, reflecting the lack of public exploit code at the time of disclosure.

No verified public proof-of-concept code exists. See the Microsoft CVE-2026-40399 Advisory for vendor technical details.

Detection Methods for CVE-2026-40399

Indicators of Compromise

• Unexpected System process crashes or bugchecks referencing tcpip.sys in MEMORY.DMP or Windows Error Reporting telemetry.
• New SYSTEM-level processes spawned shortly after a non-administrative user logs on or executes an untrusted binary.
• Kernel stack traces in crash dumps showing corrupted return addresses inside TCP/IP stack functions.

Detection Strategies

• Monitor for kernel-mode crashes with bugcheck codes such as 0x139 (KERNEL_SECURITY_CHECK_FAILURE) and 0x3B (SYSTEM_SERVICE_EXCEPTION) where the faulting module is tcpip.sys.
• Correlate local logon events (Event ID 4624 with logon type 2 or 10) with subsequent privilege assignment events (Event ID 4672) granted to non-administrative accounts.
• Hunt for processes invoking unusual Winsock or NSI IOCTLs from low-integrity contexts using EDR telemetry.

Monitoring Recommendations

• Enable kernel crash dump collection and forward WER reports to a centralized analytics platform for review.
• Track patch deployment status for the May 2026 Windows cumulative update across all Windows 10, 11, and Server endpoints.
• Alert on local privilege transitions from medium to high integrity that are not preceded by a legitimate UAC consent prompt.

How to Mitigate CVE-2026-40399

Immediate Actions Required

• Apply the May 2026 Microsoft security update referenced in the Microsoft CVE-2026-40399 Advisory to all affected Windows 10, Windows 11, and Windows Server hosts.
• Prioritize patching multi-user systems such as Remote Desktop Session Hosts, jump boxes, and shared developer workstations where low-privileged users have shell access.
• Audit local account inventories and remove unused or stale accounts that could be leveraged to satisfy the authentication requirement.

Patch Information

Microsoft released fixes for all supported affected SKUs alongside the May 2026 Patch Tuesday cycle. Administrators should consult the Microsoft CVE-2026-40399 Advisory for the specific KB article and build numbers that correspond to each Windows version.

Workarounds

• Microsoft has not published a supported configuration workaround. Apply the security update.
• Reduce risk by enforcing least-privilege policies and removing interactive logon rights for accounts that do not require them.
• Use application control solutions such as Windows Defender Application Control to restrict execution of untrusted binaries that could host exploit code.

# Verify that the May 2026 cumulative update is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Check current Windows build to confirm patch level
[System.Environment]::OSVersion.Version