CVE-2026-72981 – IP Helper Remote Code Execution Vulnerability

CVE-2026-72981 is a Critical remote code execution vulnerability in Microsoft Windows IP Helper caused by a use-after-free weakness (CWE-416). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires winning a race condition, which increases attack complexity. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: Successful exploitation could compromise the confidentiality, integrity, and availability of an affected Windows system, with each rated High in the CVSS metrics. The network attack vector, combined with no authentication or user interaction requirements, makes this a significant remote threat despite the high attack complexity.

EXPLOITS: The exploitability assessment is “Exploitation Less Likely.” Exploit code maturity is Unproven. The vulnerability is not publicly disclosed and is not known to be exploited. No public exploit, zero-day exploitation, or proof-of-concept code is confirmed.

TECHNICAL SUMMARY: The vulnerability is a use-after-free condition in Windows IP Helper. This type of flaw occurs when memory is referenced after it has been freed. An unauthenticated attacker could target an affected service over the network with a specially crafted packet. Successful exploitation requires the attacker to win a race condition, resulting in High attack complexity. If successful, the attacker could execute code on the target system. The CVSS metrics indicate no privileges and no user interaction are required, with potential High impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation can occur remotely by sending a specially crafted packet, but requires winning a race condition.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and cause serious compromise of affected Windows endpoints and servers. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could expose sensitive information, permit unauthorized system changes, or disrupt system availability.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and can enable unauthenticated remote code execution over a network without user interaction. Although exploitation is assessed as less likely and no exploitation is currently identified, organizations should prioritize deployment of the official fix because successful exploitation could have High confidentiality, integrity, and availability impacts.