Windows TCP/IP CVE-2026-34334: Brief Summary of a Kernel Race Condition Privilege Escalation

Introduction

A race condition in the Windows TCP/IP kernel driver gives any locally authenticated user a path to SYSTEM privileges, courtesy of improper synchronization around a shared resource in tcpip.sys. Microsoft patched CVE-2026-34334 in its May 2026 Patch Tuesday cycle. The flaw carries a CVSS 3.1 base score of 7.8 and affects virtually every supported version of Windows, from Windows 10 and 11 through Windows Server 2025, and even the legacy Server 2012 editions.

Microsoft rates exploitation as Unlikely, and no public exploit code exists. Even so, low attack complexity, low privilege requirements, and full SYSTEM impact make this one worth tracking, especially in environments where multiple users share access to the same host.

Technical information

Root cause

The vulnerability is classified as CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization. The flaw is in tcpip.sys, the core Windows TCP/IP kernel driver. Two or more concurrent code paths access a shared resource without adequate synchronization. That opens a timing window in which an attacker can modify the resource while another code sequence assumes it has temporary exclusive access.

The result can go beyond a driver crash. Because tcpip.sys runs in kernel mode, an attacker can turn state corrupted through this race into arbitrary privilege escalation. A successful exploit grants full SYSTEM privileges, a complete compromise of confidentiality, integrity, and availability on the affected host.

CVSS breakdown

The CVSS 3.1 base score of 7.8 (temporal: 6.8) breaks down like this:

Attack flow

From the available technical details, exploitation would proceed in four steps:

1. The attacker gets local access to the target system with a standard, low-privilege user account. That could be a shared workstation, a terminal server, or a compromised endpoint where the attacker already has a foothold.

2. The attacker invokes the vulnerable code path in the TCP/IP driver, starting two concurrent operations that compete for the improperly synchronized shared resource.

3. When the attacker wins the race, they manipulate the shared resource inside the timing window and corrupt kernel state in a controlled way.

4. The attacker uses the corrupted kernel state to elevate their process context from a low-privilege user to SYSTEM.

The specific shared resource and the exact code path have not been publicly disclosed. tcpip.sys is a closed-source Windows kernel component, so there is no source code diff to examine. No public exploit code has been released, and Microsoft classifies the exploit code maturity as Unproven.

Patch information

Microsoft released an official fix for CVE-2026-34334 on May 12, 2026, as part of the May 2026 Patch Tuesday security update cycle. The fix ships only in cumulative and security updates, through Windows Update and the Microsoft Update Catalog. Microsoft's MSRC advisory lists the Remediation Level as Official Fix, which means a complete vendor solution has shipped.

Microsoft has published no official workarounds or alternative mitigations for this vulnerability. The only recommended action is to apply the official update.

The core fix almost certainly adds proper synchronization primitives (such as spinlocks, interlocked operations, or resource acquisition ordering) around the shared-resource access path in the TCP/IP driver. By serializing the critical section, the patch eliminates the timing window an attacker could use to corrupt kernel state and escalate privileges.

Patch matrix

The patch covers a broad set of affected products:

Security Hotpatch updates

For several modern server and client editions, Microsoft also shipped Security Hotpatch updates that apply the fix without a reboot:

The hotpatch updates target slightly earlier build numbers, for example 10.0.26100.8390 for KB5089466 against 10.0.26100.8457 for the full KB5089549 update. The difference comes from the lighter-weight hotpatching approach, which avoids replacing the entire binary in memory.

Verification

To confirm the patch is installed, administrators can compare the installed OS build number against the patched build numbers above:

Get-ComputerInfo | Select-Object OsBuildNumber

They can also run winver from the Run dialog. Every update is marked "Customer Action Required: Required", so none of them is optional.

Affected systems and versions

The vulnerability affects these Windows operating systems, in all builds before the patched versions listed above:

Windows Client:

• Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64)
• Windows 10 versions 21H2 and 22H2 (x86, x64, ARM64)
• Windows 10 version 1809
• Windows 10 version 1607

Windows Server:

• Windows Server 2025
• Windows Server 2022 (including 23H2 Server Core)
• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2
• Windows Server 2012

The vulnerable component is tcpip.sys, the Windows TCP/IP kernel driver, which is present and active by default on all of these platforms.

References

• Microsoft Security Response Center: CVE-2026-34334
• NVD: CVE-2026-34334
• Zero Day Initiative: The May 2026 Security Update Review
• VulDB: CVE-2026-34334 Microsoft Windows TCP/IP Race Condition
• Bleeping Computer: Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No Zero Days
• SANS Internet Storm Center: Microsoft May 2026 Patch Tuesday
• Tenable: Windows Server version 23H2 Security Update (May 2026)