Brief Summary: CVE-2026-33837 — Windows TCP/IP Heap Buffer Overflow Enabling Kernel Privilege Escalation

Introduction

A heap-based buffer overflow in the Windows TCP/IP kernel driver gives any local user with low privileges a path to full kernel control. The flaw is in tcpip.sys, is tracked as CVE-2026-33837, and was patched in Microsoft's May 2026 Patch Tuesday cycle. It affects a broad range of Windows client and server operating systems, so it is relevant to virtually every enterprise environment that runs Windows.

Technical Information

Root Cause

The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). It sits in tcpip.sys, the kernel-mode driver that implements the Windows TCP/IP networking stack. A locally running process triggers the flaw by interacting with the driver in a way that writes past the end of a heap-allocated buffer in kernel memory. Because tcpip.sys runs at ring 0, corrupting its heap memory can let an attacker overwrite adjacent kernel data structures and eventually hijack execution flow, which gives them kernel-level privileges.

CVSS Breakdown

Microsoft assigned a CVSS 3.1 base score of 7.8 with the following vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The vector breaks down as follows:

• Attack Vector: Local. The attacker needs local access to the target machine.
• Attack Complexity: Low. The attack needs no special conditions or race windows.
• Privileges Required: Low. A standard, unprivileged user account is enough.
• User Interaction: None. No other user has to do anything.
• Impact: High for Confidentiality, Integrity, and Availability.
• Scope: Unchanged. The privilege escalation happens within the same security authority (the Windows kernel).

The temporal score is 6.8. It is lower than the base score because exploit code maturity was "Unproven" at the time of publication and an official fix is available.

Attack Flow

1. The attacker gets local access to a Windows system and can execute code as a low-privileged user.
2. The attacker runs a specially crafted application that sends specific input to the tcpip.sys driver, aimed at the vulnerable code path.
3. The crafted input triggers the heap buffer overflow, which writes data past the allocated buffer boundary in kernel heap memory.
4. The overflow corrupts adjacent kernel heap structures, and the attacker uses that corruption to gain arbitrary code execution in kernel mode.
5. With kernel-level privileges, the attacker has unrestricted control over the system. They can install persistent backdoors, disable security software, or read any data on the machine.

Patch Information

Microsoft released the official fix for CVE-2026-33837 on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. tcpip.sys is a closed-source Windows kernel component, so there is no public source code diff. The fix ships only through cumulative Windows security updates. Based on the advisory, the patch fixes the heap-based buffer overflow by adding proper bounds checking or buffer size validation to the vulnerable code path in the driver.

Microsoft has stated that there are no workarounds or alternative mitigations. Patching is the only remediation path.

The table below lists the affected product families, their KB articles, and the patched build numbers:

For several newer platforms (Windows Server 2025, Windows Server 2022, Windows 11 24H2, and Windows 11 25H2), Microsoft offers both a standard security update and a Security Hotpatch Update. A hotpatch applies the fix in memory without an immediate reboot, which matters most on production servers where downtime has to stay as short as possible.

All updates carry a customer action designation of "Required." They are available through Windows Update, the Microsoft Update Catalog, and WSUS. To verify that a system is patched, administrators should confirm that its OS build number meets or exceeds the value listed above for that product.

Detection Methods

Snort IDS/IPS Signatures

Cisco Talos released Snort intrusion detection rules for CVE-2026-33837 on May 12, 2026, the same day Microsoft published its advisory. Organizations running Snort can deploy the following rules:

• Snort 2: GID 1, SIDs 66440 and 66441. These rules were written specifically for CVE-2026-33837 and belong to the broader May 2026 Patch Tuesday update range (1:66438 through 1:66445).
• Snort 3: GID 1, SID 301495. This rule falls within the range 1:301494 through 1:301497 included in the same release.

The rules are available to Snort Subscriber Ruleset customers. Cisco Secure Firewall users should update their Security Rule Update (SRU) to the latest version to get this coverage automatically. Open-source Snort users can get the rules through the Snort.org rule pack.

Supplementary Monitoring

Microsoft assessed exploitation as "More Likely," so defenders should also watch for suspicious local process activity on Windows systems, especially unexpected privilege transitions by processes that interact with the TCP/IP stack. As an additional detection layer, monitor Windows Event Logs for anomalous service or kernel-mode behavior tied to the networking subsystem.

At this time, no YARA rules, Sigma rules, or published indicators of compromise (IoCs) have been identified for this vulnerability beyond the Snort signatures above.

Affected Systems and Versions

CVE-2026-33837 affects a wide range of Windows client and server operating systems. The following versions are confirmed vulnerable until the May 2026 patches are applied:

Windows Client:

• Windows 11 Version 26H1 (x64, ARM64)
• Windows 11 Version 25H2 (x64, ARM64)
• Windows 11 Version 24H2 (x64, ARM64)
• Windows 11 Version 23H2 (x64, ARM64)
• Windows 10 Version 22H2 (x64, ARM64, x86)
• Windows 10 Version 21H2 (x64, ARM64, x86)
• Windows 10 Version 1809 (x64, x86)
• Windows 10 Version 1607 (x64, x86)

Windows Server:

• Windows Server 2025 (including Server Core installation)
• Windows Server 2022, 23H2 Edition (Server Core installation)
• Windows Server 2022 (including Server Core installation)
• Windows Server 2019 (including Server Core installation)
• Windows Server 2016 (including Server Core installation)
• Windows Server 2012 R2 (including Server Core installation)
• Windows Server 2012 (including Server Core installation)

The vulnerable component is the tcpip.sys kernel driver, which is present in every configuration above.

Vendor Security History

Microsoft ships security updates on a fixed monthly cycle. The May 2026 Patch Tuesday release fixed 120 security flaws across Microsoft's products, and none of them were classified as zero days. CVE-2026-33837 was one of the vulnerabilities in that batch rated "Exploitation More Likely." That rating is a reason to deploy the patch promptly, even though no active exploitation has been observed.

References

• CVE-2026-33837, MSRC Security Update Guide
• NVD Entry for CVE-2026-33837
• CVE Record: CVE-2026-33837
• Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days (BleepingComputer)
• Microsoft Patch Tuesday May 2026 Report (BleepingComputer)
• The May 2026 Security Update Review (Zero Day Initiative)
• Microsoft Patch Tuesday for May 2026, Snort Rules and Prominent Vulnerabilities (Cisco Talos)
• Snort Subscriber Rules Update, May 2026 (Seclists)