Description
Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
Published: 2026-09-08
Score: 7.5 High
EPSS: 1.2% Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Missing release of memory after its intended lifetime in the Windows TCP/IP stack enables an unauthenticated attacker to send specially crafted packets that keep resources allocated. The flaw causes a gradual exhaustion of network‑layer memory, eventually rendering the affected system unable to process normal network traffic. The vulnerability leads solely to a denial of service; it provides no code execution or privilege escalation path.

Affected Systems

The flaw affects Microsoft Windows 11 across versions 23H2, 24H2, 25H2, and 26H1, and Windows Server 2022 and Windows Server 2025, including the Server Core installation.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of 1% suggests a low but non‑negligible probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over a network: an unauthenticated attacker can send specially crafted TCP/IP packets to trigger the memory leak, potentially affecting any exposed system at remote sites.

Generated by OpenCVE AI on September 10, 2026 at 01:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the Windows security update for CVE‑2026‑69588 as released by Microsoft; see the MSRC update guide for the relevant advisories.
  • Configure Windows Defender Firewall to block or restrict network traffic on TCP/IP ports that can be abused to trigger the memory leak, especially from untrusted sources.
  • Continuously monitor memory usage and network activity for sudden spikes or service interruptions that may indicate exploitation attempts.

Generated by OpenCVE AI on September 10, 2026 at 01:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*

Thu, 10 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2025 (server Core Installation)

Tue, 08 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
Title Windows TCP/IP Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-401
CPEs cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-25T21:31:46.347Z

Reserved: 2026-08-03T21:18:49.123Z

Link: CVE-2026-69588

cve-icon Vulnrichment

Updated: 2026-09-08T20:56:35.447Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T18:19:29.010

Modified: 2026-09-18T14:35:08.230

Link: CVE-2026-69588

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T21:10:16Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime