Microsoft Windows IP Over USB Service: Elevation of privilege

Summary

A flaw in the Windows IP Over USB Service, caused by an integer overflow or wraparound (CWE-190), allows a local attacker to elevate privileges. The attacker needs a valid local user account with low privileges, and no user interaction is required. Successful exploitation could give the attacker full control (high impact on confidentiality, integrity and availability) of the affected system.

Affected

• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Windows 10 21H2: 10.0.19044.7807 (per CNA data; verify on MSRC)
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 25H2, 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650
• Fix included in the October 2026 Microsoft security update.

Workaround

• Per Microsoft (as mirrored by OpenCVE): disable the Windows IP Over USB Service or restrict its use to trusted administrators until the patch is applied.
• The exact service name and disable procedure are unconfirmed; check the MSRC advisory before implementing.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog.
• EPSS score 0.00341.
• No public proof of concept or reports of in-the-wild exploitation found.

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows systems, prioritising Windows 10 21H2 devices.
• Check whether Windows 10 21H2 devices still receive security updates or are enrolled in Extended Security Updates; unpatched 21H2 systems remain exposed.
• Until patched, restrict local logon and administrative rights on shared PCs, terminal servers and multi-user workstations.
• Verify the fixed builds and the service-disable steps on the MSRC advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70008 msrc.microsoft.com
• CVE record mirror (Vulners CVELIST) vulners.com
• OpenCVE: CVE-2026-70008 app.opencve.io
• Strix.ai: CVE-2026-70008 www.strix.ai
• Vulnrichment (SSVC/CISA data) via Vulners vulners.com
• Tenable plugin 365467 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:34.