TALOS-2026-2427

CVE-2026-49177

An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet (IRP) can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition.

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

TCP/IP Driver (version(s): 10.0.26100.8457)

TCP/IP Driver – https://www.microsoft.com/

8.4 – CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

CWE-125 – Out-of-bounds Read

Windows tcpip.sys is a core kernel-mode networking driver that implements major parts of the IPv4/IPv6 TCP/IP stack, including IP, TCP, UDP, ICMP, routing, and packet handling logic. It works with NDIS miniport drivers, filter drivers, WFP, Winsock/AFD, and other networking components to move network traffic between applications and network adapters.

When a specially crafted IRP request is sent to the handler for the `0x120007` IOCTL, it invokes the `IpGetAllSortedAddressParameters` function.
fffff8055387cf20 uint64_t IpGetAllSortedAddressParameters(void* arg1)

“`
fffff8055387cf20 { fffff8055387cf20 int32_t* KeyBuffer = *(uint64_t*)((char*)arg1 + 0x10); //<———- (1) fffff8055387cf3a uint128_t* rsi = *(uint64_t*)((char*)arg1 + 0x38); fffff8055387cf3a fffff8055387cf3e if (!Ipv6Global) fffff8055387cf63 return 0xc00000bb; fffff8055387cf63 […] fffff8055387cffb if (!*(uint32_t*)KeyBuffer || rax_5) fffff8055387cffb { fffff8055387cf93 memset(rsi, 0, 0x4658); fffff8055387cfdb rbx = IppCreateSortedAddressPairsEx(rax_1, KeyBuffer[0xdae], rsi, fffff8055387cfdb &rsi[0x36b], &KeyBuffer[1], KeyBuffer[0xdad], fffff8055387cfdb (char*)rsi + 0x36b4, (char*)rsi + 0x4654); //<————– (2) fffff8055387cffb }
“`

At `(1)`, the user-controlled input buffer, `KeyBuffer`, is read. The size of `KeyBuffer` is `0x36bc` bytes. Later, at `(2)`, the `IppCreateSortedAddressPairsEx` function is called. The second, fourth, and fifth arguments are derived from the `KeyBuffer` buffer. For this vulnerability, the fifth argument, `MaxDestCount`, is important.

“`
fffff8055387d075 int32_t MaxDestCount_1 = MaxDestCount; fffff8055387d079 int64_t P_2 = 0; fffff8055387d07d *(uint32_t*)arg4 = 0; fffff8055387d083 int32_t rbx; fffff8055387d083 fffff8055387d083 if (!MaxDestCount) //<————– (3) fffff8055387d120 rbx = 0; fffff8055387d083 else fffff8055387d083 { fffff8055387d092 int64_t* rax_1 = IppFindCompartmentById(&Ipv4Global, *(uint32_t*)rdi); fffff8055387d0a9 rsi = rax_1; fffff8055387d0ac IppQualifyAddresses(rdi, &MaxDestCount_1, keybuf_off4, nullptr); //<————– (4) fffff8055387d0bf int32_t rax_2;
“`

In `IppCreateSortedAddressPairsEx`, if `MaxDestCount` is non-zero, then `IppQualifyAddresses` is called at `(4)` to filter the destination addresses. The `KeyBuffer` pointer is incremented by 4 bytes and passed to the `IppQualifyAddresses` function.
fffff8055387d800 int32_t* IppQualifyAddresses(int64_t* arg1, int32_t* MaxDestCount,
fffff8055387d800 void* keybuf_off4, void* const arg4)

“`
fffff8055387d800 { fffff8055387d800 int32_t* result = MaxDestCount; fffff8055387d821 uint64_t MaxDestCount_1 = (uint64_t)*(uint32_t*)MaxDestCount; […] fffff8055387d83b fffff8055387d841 if ((uint32_t)MaxDestCount_1) fffff8055387d841 { fffff8055387d843 char* r8 = (char*)keybuf_off4 + 9; fffff8055387d843 fffff8055387d871 do //<————– (5) fffff8055387d871 { fffff8055387d850 char rcx = r8[-1]; fffff8055387d850 fffff8055387d858 if (rcx == 0xfe) fffff8055387d858 { fffff8055387d912 if ((*(uint8_t*)r8 & 0xc0) != 0xc0) fffff8055387d912 { fffff8055387d97d if (rcx == 0xfe && (*(uint8_t*)r8 & 0xc0) == 0x80) fffff8055387d97d { fffff8055387d987 r15 = (uint64_t)(uint8_t)r15; fffff8055387d987 […] fffff8055387d858 } fffff8055387d858 fffff8055387d867 i += 1; fffff8055387d86a r8 = &r8[0x1c]; fffff8055387d871 } while (i < (uint32_t)MaxDestCount_1); //<————– (6) fffff8055387d841 } fffff8055387d841
“`

The vulnerability occurs in `IppQualifyAddresses`. In `IppQualifyAddresses`, a loop starts at `(5)` and runs `MaxDestCount` times. It first increments `KeyBuffer` by 0x8, and in each iteration, `KeyBuffer` is increased by `0x1c`. Therefore, if the value of `MaxDestCount` is greater than `(0x36bc – 4 – 8) // 0x1c = 0x1f4`, an out-of-bounds read occurs.

This can be observed while debugging the machine with WinDbg:
: kd> g
Breakpoint 0 hit
tcpip!IppQualifyAddresses+0x21:
fffff807 `24b2d821 448b32 mov r14d,dword ptr [rdx]
1: kd> r
rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=ffffe40dc14898a0
rdx=ffffce0b5f3a6c18 rsi=ffffe40dc14878a0 rdi=ffffe40dc14898a0
rip=fffff80724b2d821 rsp=ffffce0b5f3a6b80 rbp=ffffce0b5f3a6c48
r8=ffffe40dc4b1e06c r9=0000000000000000 r10=fffff80790ff9690
r11=ffffce0b5f3a6cc0 r12=0000000000000000 r13=00000000bbbbbbbb
r14=0000000000000000 r15=fffff80724c963d8
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040282
tcpip!IppQualifyAddresses+0x21:
fffff807` 24b2d821 448b32 mov r14d,dword ptr [rdx] ds:002b:ffffce0b `5f3a6c18=bbbbbbbb;<——— (7)
1: kd> p
tcpip!IppQualifyAddresses+0x24:
fffff807` 24b2d824 33f6 xor esi,esi
1: kd> p
tcpip!IppQualifyAddresses+0x26:
fffff807 `24b2d826 8b3d7c861200 mov edi,dword ptr [tcpip!scopeid_unspecified (fffff807` 24c55ea8)]
1: kd> p
tcpip!IppQualifyAddresses+0x2c:
fffff807 `24b2d82c 498be9 mov rbp,r9
1: kd> p
tcpip!IppQualifyAddresses+0x2f:
fffff807` 24b2d82f 4532c9 xor r9b,r9b
1: kd> p
tcpip!IppQualifyAddresses+0x32:
fffff807 `24b2d832 4532ff xor r15b,r15b
1: kd> p
tcpip!IppQualifyAddresses+0x35:
fffff807` 24b2d835 4d8be8 mov r13,r8
1: kd> p
tcpip!IppQualifyAddresses+0x38:
fffff807 `24b2d838 4c8be1 mov r12,rcx
1: kd> p
tcpip!IppQualifyAddresses+0x3b:
fffff807` 24b2d83b 448bd6 mov r10d,esi
1: kd> p
tcpip!IppQualifyAddresses+0x3e:
fffff807 `24b2d83e 4585f6 test r14d,r14d
1: kd> p
tcpip!IppQualifyAddresses+0x41:
fffff807` 24b2d841 7430 je tcpip!IppQualifyAddresses+0x73 (fffff807 `24b2d873)
1: kd> p
tcpip!IppQualifyAddresses+0x43:
fffff807` 24b2d843 4983c009 add r8,9
1: kd> p
tcpip!IppQualifyAddresses+0x47:
fffff807 `24b2d847 448d5e01 lea r11d,[rsi+1]
1: kd> p
tcpip!IppQualifyAddresses+0x4b:
fffff807` 24b2d84b 0f1f440000 nop dword ptr [rax+rax]
1: kd> p
tcpip!IppQualifyAddresses+0x50:
fffff807 `24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
1: kd> r
rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=ffffe40dc14898a0
rdx=ffffce0b5f3a6c18 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80724b2d850 rsp=ffffce0b5f3a6b80 rbp=0000000000000000
r8=ffffe40dc4b1e075 r9=0000000000000000 r10=0000000000000000
r11=0000000000000001 r12=ffffe40dc14898a0 r13=ffffe40dc4b1e06c
r14=00000000bbbbbbbb r15=fffff80724c96300
iopl=0 nv up ei ng nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040292
tcpip!IppQualifyAddresses+0x50:
fffff807` 24b2d850 410fb648ff movzx ecx,byte ptr [r8-1] ds:002b:ffffe40d `c4b1e074=00 ; <————- (8)
1: kd> db r8-c
ffffe40d` c4b1e069 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d `c4b1e079 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d` c4b1e089 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d `c4b1e099 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d` c4b1e0a9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d `c4b1e0b9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d` c4b1e0c9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
ffffe40d `c4b1e0d9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 …………….
1: kd> bp
1: kd> g
Breakpoint 1 hit
tcpip!IppQualifyAddresses+0x50:
fffff807` 24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
1: kd> g
Breakpoint 1 hit
tcpip!IppQualifyAddresses+0x50:
fffff807 `24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
1: kd> r
rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=0000000000000000
rdx=ffffce0b5f3a6c18 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80724b2d850 rsp=ffffce0b5f3a6b80 rbp=0000000000000000
r8=ffffe40dc4b1e0ad r9=0000000000000000 r10=0000000000000002
r11=0000000000000001 r12=ffffe40dc14898a0 r13=ffffe40dc4b1e06c
r14=00000000bbbbbbbb r15=fffff80724c96300
iopl=0 nv up ei pl nz ac pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040217
tcpip!IppQualifyAddresses+0x50:
fffff807` 24b2d850 410fb648ff movzx ecx,byte ptr [r8-1] ds:002b:ffffe40d `c4b1e0ac=00
1: kd> u
tcpip!IppQualifyAddresses+0x50:
fffff807` 24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
fffff807 `24b2d855 80f9fe cmp cl,0FEh
fffff807` 24b2d858 0f84ac000000 je tcpip!IppQualifyAddresses+0x10a (fffff807 `24b2d90a)
fffff807` 24b2d85e 4584c9 test r9b,r9b
fffff807 `24b2d861 0f85bb000000 jne tcpip!IppQualifyAddresses+0x122 (fffff807` 24b2d922)
fffff807 `24b2d867 41ffc2 inc r10d
fffff807` 24b2d86a 4983c01c add r8,1Ch
fffff807 `24b2d86e 453bd6 cmp r10d,r14d
1: kd> g
Breakpoint 1 hit
tcpip!IppQualifyAddresses+0x50:
fffff807` 24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]

In this case, the value of `MaxDestCount` is `0xbbbbbbbb`, which can be observed at `(7)`. The loop reads `KeyBuffer` at `(8)`. Here, `MaxDestCount` is greater than `0x1f4`, so if the loop continues, the following crash can be observed:

“`
1: kd> g KDTARGET: Refreshing KD connection *** Fatal System Error: 0x00000050 (0xFFFFE40DC4B23014,0x0000000000000000,0xFFFFF80724B2D850,0x0000000000000002) Driver at fault: *** tcpip.sys – Address FFFFF80724B2D850 base at FFFFF80724A70000, DateStamp 3fc564c3 . Break instruction exception – code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. nt!DbgBreakPointWithStatus: fffff807`910f92d0 cc int 3 1: kd> !analyze -v -a ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffe40dc4b23014, memory referenced. Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE. bit 1 is set if the fault was due to a write, clear if a read. bit 3 is set if the processor decided the fault was due to a corrupted PTE. bit 4 is set if the fault was due to attempted execute of a no-execute PTE. – ARM64: bit 1 is set if the fault was due to a write, clear if a read. bit 3 is set if the fault was due to attempted execute of a no-execute PTE. Arg3: fffff80724b2d850, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: —————— *** WARNING: Unable to verify checksum for poc.exe Unable to load image C:UsersdevDownloadspoc.exe, Win32 error 0n2 *** WARNING: Unable to verify checksum for poc.exe Unable to load image C:UsersdevDownloadspoc.exe, Win32 error 0n2 *** WARNING: Unable to verify checksum for poc.exe Unable to load image C:UsersdevDownloadspoc.exe, Win32 error 0n2 KEY_VALUES_STRING: 1 Key : AV.PTE Value: Invalid Key : AV.Page.Virtual Value: 0xffffe40dc4b20000 Key : AV.Type Value: Read Key : Analysis.CPU.mSec Value: 20421 Key : Analysis.Elapsed.mSec Value: 71615 Key : Analysis.IO.Other.Mb Value: 92 Key : Analysis.IO.Read.Mb Value: 34 Key : Analysis.IO.Write.Mb Value: 125 Key : Analysis.Init.CPU.mSec Value: 572390 Key : Analysis.Init.Elapsed.mSec Value: 109313545 Key : Analysis.Memory.CommitPeak.Mb Value: 255 Key : Analysis.Version.DbgEng Value: 10.0.29547.1002 Key : Analysis.Version.Description Value: 10.2602.27.2 amd64fre Key : Analysis.Version.Ext Value: 1.2602.27.2 Key : Bugcheck.Code.KiBugCheckData Value: 0x50 Key : Bugcheck.Code.LegacyAPI Value: 0x50 Key : Bugcheck.Code.TargetModel Value: 0x50 Key : Failure.Bucket Value: AV_NETIO!NsiGetParameterEx Key : Failure.Exception.IP.Address Value: 0xfffff80724b2d850 Key : Failure.Exception.IP.Module Value: tcpip Key : Failure.Exception.IP.Offset Value: 0xbd850 Key : Failure.Hash Value: {144d820d-4433-7015-42ee-2ff721fb50d9} Key : Faulting.IP.Type Value: Paged Key : Hypervisor.Enlightenments.Value Value: 12576 Key : Hypervisor.Enlightenments.ValueHex Value: 0x3120 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 0 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 0 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 0 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 1 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 0 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 0 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 0 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 1 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 0 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 536632 Key : Hypervisor.Flags.ValueHex Value: 0x83038 Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 0 Key : Hypervisor.RootFlags.AccessStats Value: 0 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 0 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 0 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 0 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 0 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 0 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 0 Key : Hypervisor.RootFlags.MceEnlightened Value: 0 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 0 Key : Hypervisor.RootFlags.Value Value: 0 Key : Hypervisor.RootFlags.ValueHex Value: 0x0 Key : SecureKernel.HalpHvciEnabled Value: 0 Key : WER.OS.Branch Value: ge_release Key : WER.OS.Version Value: 10.0.26100.1 BUGCHECK_CODE: 50 BUGCHECK_P1: ffffe40dc4b23014 BUGCHECK_P2: 0 BUGCHECK_P3: fffff80724b2d850 BUGCHECK_P4: 2 FAULTING_THREAD: ffffe40dc4bc6080 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffe40dc4b23014 READ_ADDRESS: ffffe40dc4b23014 Nonpaged pool MM_INTERNAL_CODE: 2 PROCESS_NAME: poc.exe IP_IN_PAGED_CODE: tcpip!IppQualifyAddresses+50 fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1] STACK_TEXT: *** WARNING: Unable to verify checksum for poc.exe Unable to load image C:UsersdevDownloadspoc.exe, Win32 error 0n2 ffffce0b`5f3a5f58 fffff807`911afa92 : ffffce0b`5f3a5fd8 00000000`00000001 00000000`00000080 fffff807`912c2a01 : nt!DbgBreakPointWithStatus ffffce0b`5f3a5f60 fffff807`911aefbe : 00000000`00000003 ffffce0b`5f3a60c0 fffff807`912c2c90 ffffce0b`5f3a6680 : nt!KiBugCheckDebugBreak+0x12 ffffce0b`5f3a5fc0 fffff807`910f8557 : 00000000`00000000 fffff807`90f0caf2 ffffe40d`c4b23014 00000000`00000000 : nt!KeBugCheck2+0xb2e ffffce0b`5f3a6750 fffff807`90f0e960 : 00000000`00000050 ffffe40d`c4b23014 00000000`00000000 ffffce0b`5f3a69f0 : nt!KeBugCheckEx+0x107 ffffce0b`5f3a6790 fffff807`90e43e96 : 00000000`00000000 ffff8000`00000000 ffffe40d`c4b23014 0000007f`fffffff8 : nt!MiSystemFault+0x850 ffffce0b`5f3a6880 fffff807`912b80cb : 004e005c`00000000 00000000`00000006 00000000`00000000 ffffce0b`5f3a6a70 : nt!MmAccessFault+0x646 ffffce0b`5f3a69f0 fffff807`24b2d850 : 00000000`00000015 ffffce0b`5f3a74a0 fffff807`249d4d60 00000000`00000015 : nt!KiPageFault+0x38b ffffce0b`5f3a6b80 fffff807`24b2d0b1 : ffffe40d`c4b1e068 ffffce0b`5f3a6c18 ffffce0b`5f3a6c48 ffffe40d`c14878a0 : tcpip!IppQualifyAddresses+0x50 ffffce0b`5f3a6bd0 fffff807`24b2cfdb : ffffe40d`c14898a0 ffffce0b`000000aa ffffe40d`c4b19000 ffffe40d`c4b1c6b0 : tcpip!IppCreateSortedAddressPairsEx+0x91 ffffce0b`5f3a6c90 fffff807`2496be03 : 00000000`00004658 00000000`00004658 00000000`00004658 ffffe40d`c4b1e000 : tcpip!IpGetAllSortedAddressParameters+0xbb ffffce0b`5f3a6ce0 fffff807`25b32faa : 000001f1`0e2b5fd0 ffffe40d`c4b1e000 00000000`00000000 000001f1`0e2b5fd0 : NETIO!NsiGetParameterEx+0x603 ffffce0b`5f3a6e50 fffff807`25b32968 : 00000000`00000000 ffffe40d`c3189440 ffffe40d`c3189370 000001f1`0e2b5fd0 : nsiproxy!NsippGetParameter+0x2aa ffffce0b`5f3a6fe0 fffff807`90e5ccfb : ffffce0b`5f3a7110 00000000`00000002 00000000`00000000 00000000`00000001 : nsiproxy!NsippDispatch+0xd8 ffffce0b`5f3a7030 fffff807`90e5cc73 : ffffce0b`5f3a70b0 ffffe40d`c4bc6910 00000000`00000000 ffffe40d`c4bc6958 : nt!IopfCallDriver+0x5b ffffce0b`5f3a7070 fffff807`914cb3a5 : ffffe40d`c5e258d0 ffffce0b`5f3a7110 ffffe40d`c1795060 00000000`00000000 : nt!IofCallDriver+0x13 ffffce0b`5f3a70a0 fffff807`914ca1ec : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5 ffffce0b`5f3a7150 fffff807`914c983e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c ffffce0b`5f3a73c0 fffff807`912bc555 : 00000000`00000001 000000a7`b08fa4c0 ffffce0b`5f3a7520 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e ffffce0b`5f3a7430 00007ff8`ea141d84 : 00007ff8`e7635c43 000000a7`b08fc038 000000a7`b08fc040 000000a7`b08fc048 : nt!KiSystemServiceCopyEnd+0x25 000000a7`b08fbfe8 00007ff8`e7635c43 : 000000a7`b08fc038 000000a7`b08fc040 000000a7`b08fc048 0000df38`66e83860 : ntdll!NtDeviceIoControlFile+0x14 000000a7`b08fbff0 00007ff8`e7d83335 : 00000000`00120007 00007ff6`63571531 00007ff6`63591298 00007ff6`63591128 : KERNELBASE!DeviceIoControl+0x73 000000a7`b08fc060 00007ff6`63571424 : 000001f1`0e2b0020 000001f1`0e040000 00000000`00000000 00000000`00000000 : KERNEL32!DeviceIoControlImplementation+0x75 000000a7`b08fc0b0 000001f1`0e2b0020 : 000001f1`0e040000 00000000`00000000 00000000`00000000 00000000`00000000 : poc+0x1424 000000a7`b08fc0b8 000001f1`0e040000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000001f1`0e2b0020 000000a7`b08fc0c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 000000a7`b08fc118 : 0x000001f1`0e040000 SYMBOL_NAME: NETIO!NsiGetParameterEx+603 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS STACK_COMMAND: .process /r /p 0xffffe40dc4ac3080; .thread /r /p 0xffffe40dc4bc6080 ; kb BUCKET_ID_FUNC_OFFSET: 603 FAILURE_BUCKET_ID: AV_NETIO!NsiGetParameterEx OS_VERSION: 10.0.26100.1 BUILDLAB_STR: ge_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {144d820d-4433-7015-42ee-2ff721fb50d9} Followup: MachineOwner ——— kd>lmDvm tcpip Browse full module list start end module name fffff807`24a70000 fffff807`24dc9000 tcpip (pdb symbols) C:ProgramDataDbgsymtcpip.pdbD6947ED1ADE91B23FA5AFE8178A2AF0F1tcpip.pdb Loaded symbol image file: tcpip.sys Image path: SystemRootSystem32driverstcpip.sys Image name: tcpip.sys Browse all global symbols functions data Symbol Reload Image was built with /Brepro flag. Timestamp: 3FC564C3 (This is a reproducible build file hash, not a timestamp) CheckSum: 00354B4C ImageSize: 00359000 Mapping Form: Loaded Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 Information from resource tables:
“`

Vendor Link: https://windowsforum.com/security-alerts.84/cve-2026-49177-july-14-updates-fix-windows-tcp-ip-data-leak.438177/

2026-06-01 – Vendor Disclosure

2026-07-14 – Vendor Patch Release

KPC of Cisco Talos