Microsoft Windows TCP/IP: Remote code execution via use-after-free

Summary

A use-after-free flaw in the Windows TCP/IP networking stack allows an unauthorized attacker to execute code remotely over the network. The attack is rated high complexity and requires no privileges and no user interaction. Systems reachable from untrusted networks are the most exposed.

Affected

• Windows 10 Version 1607: builds 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: builds 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): see official advisory for builds
• Windows Server 2016: builds 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Security update released on 13 October 2026 (see MSRC advisory for the KB number per build)
• Windows 10 1809 / Server 2019: KB5126651 (per third-party data)
• Windows Server 2025: KB5126646 (per third-party data)
• Windows 10 1607: Unknown, check the MSRC page

Workaround

Unknown. No vendor-documented workaround was confirmed in the sources reviewed. Check the MSRC Mitigations and Workarounds sections.

Exploitation

• Not listed in CISA KEV; CISA SSVC: exploitation none, automatable no, technical impact total
• EPSS about 0.5 to 0.7 percent
• No public proof of concept found in the sources reviewed

Our recommendation

• Inventory Windows hosts by exact build number, including legacy Windows 10 1607 and Server 2016 systems
• Apply the 13 October 2026 cumulative update to every affected build, starting with internet-reachable servers and RDP/SMB-facing hosts
• Check MSRC for mitigations if patching is delayed
• Check lifecycle status of Windows 10 1607 and Server 2016 devices
• Monitor CISA KEV and vendor advisories for changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69913 msrc.microsoft.com
• OpenCVE: CVE-2026-69913 app.opencve.io
• Vulners NVD mirror: CVE-2026-69913 vulners.com
• Vulners CVE: CVE-2026-69913 vulners.com
• Rapid7 via Vulners: CVE-2026-69913 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:36.