PT-2026-32886 · Microsoft · Windows Server 2025+5

Published 2026-04-14 · Updated 2026-05-16 · CVE-2026-33827

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows 10 versions 10.0.14393.0 through 10.0.14393.9059 Microsoft Windows 10 (affected versions not specified) Microsoft Windows 11 (affected versions not specified) Microsoft Windows Server 2019 (affected versions not specified) Microsoft Windows Server 2022 (affected versions not specified) Microsoft Windows Server 2025 (affected versions not specified)

Description A race condition in the Windows TCP/IP stack, specifically within the kernel-mode driver tcpip.sys, allows an unauthorized remote attacker to execute arbitrary code with System-level privileges. The issue occurs during the reassembly of fragmented IPv6 packets when IPSec is enabled. A race condition exists between the thread verifying IPSec signatures and the thread managing the fragment reassembly buffer. By sending concurrent streams of malformed IPv6 fragments, an attacker can trigger a Use-After-Free or Double-Free condition in the reassembly buffer, allowing the injection of a malicious payload into kernel memory. This is a zero-click exploit that bypasses user-mode firewalls and Endpoint Detection and Response (EDR) hooks.

Recommendations For Windows 10 version 10.0.14393.0 through 10.0.14393.9059, deploy the April 2026 Cumulative Update and perform a full system restart. For Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, deploy the April 2026 Cumulative Update and perform a full system restart. As a temporary mitigation, configure edge firewalls to drop all incoming IPv6 traffic with Fragment Extension Headers (Header Type 44). As a temporary mitigation, disable IPSec if it is not strictly required for internal communication. As a temporary mitigation, run the command netsh int ipv6 set global reassemblylimit=0 in an elevated prompt to limit reassembly risks.

Fix

RCE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2026-05329

CVE-2026-33827

Affected Products

Windows

Windows 10

Windows 11

Windows Server 2019

Windows Server 2022

Windows Server 2025

References · 26

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33827 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33827 · Security Note
• https://bdu.fstec.ru/vul/2026-05329 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-33827 · Vendor Advisory
• https://twitter.com/Abhs_tweets/status/2045745218645844476 · Twitter Post
• https://reddit.com/r/AZURE/comments/1tegz4m/microsofts_mdash_agentic_ai_system_found_a · Reddit Post
• https://twitter.com/CVEnew/status/2044358557701697804 · Twitter Post
• https://twitter.com/integ_sec/status/2045838596133867895 · Twitter Post
• https://twitter.com/thezdi/status/2044167978938237299 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2054664253894746571 · Twitter Post
• https://reddit.com/r/privacychain/comments/1su9jcp/core_infestation_the_stackshatter_race_cvss_98 · Reddit Post
• https://twitter.com/inferlume_hq/status/2045799128224223267 · Twitter Post
• https://twitter.com/Abhs_tweets/status/2045782133239603655 · Twitter Post
• https://twitter.com/hmier/status/2044415231988781494 · Twitter Post