CVE-2026-42904General(microsoft / windows_10_21h2)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft windows_10_21h2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.

microsoft CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904

Weakness type (CWE)

CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2

Threat summary

Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 3 classified signals
Disclosure: 1 classified signal
Peaked 3d ago at 1 mentions (2026-06-09); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

microsoft

Products

windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2022windows_server_2025

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

General

375.0%

Disclosure

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	1	General1
2026-06-10	1	Disclosure1
2026-06-14	1	General1
2026-07-06	1	General1

Full discourse4 posts

Horizon Secured@horizon_secured137d
General
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
The post announces a set of new zero-day CVEs for June 2026, listing their IDs, severity scores, and general impact types, but provides no PoC, exploit code, patch, or evidence of active exploitation.
2201761.9K
2.6K followersView on X
IntegSec@integ_sec110d
General
CVE-2026-42904: Windows TCP/IP Heap Buffer Overflow - What It Means for Your Business and How to Respond https://hubs.li/Q04nC6W50
Post summary
The text only mentions a new Windows TCP/IP heap buffer overflow CVE, providing its type but not any PoC, exploit, patch, or active exploitation details.
0000039
31 followersView on X
ゆぅさん@YY20424277132d
General
【3軸解説】「マイクロソフトのMicrosoft Windows 10 21h2等の複数製品におけるヒープベースのバッファオーバーフローの脆弱性（CVE-2026-42904）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ note メンバーシップ: https://note.com/yuusan_security/membership
Post summary
The note offers a structured background/ purpose/ effect analysis of the CVE‑2026‑42904 heap‑buffer overflow in Windows 10 21h2, without providing PoC, exploit, or patch details.
0000060
858 followersView on X
WindowsForum@windowsforum136d
Disclosure
🪟 CVE-2026-42904: TCP/IP heap overflow → “adjacent network” → SYSTEM. Love how Microsoft calls it elevation-of-privilege like it’s a minor inconvenience. Patch fast. #Windows #Microsoft #PatchTuesday https://windowsforum.com/threads/cve-2026-42904-windows-tcp-ip-heap-overflow-could-grant-system-privileges.424795/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #SecurityAdvisory #PrivilegeEscalation #PatchTuesday https://t.co/nXHNeRx2yC
Post summary
The tweet announces CVE‑2026‑42904, a TCP/IP heap overflow that elevates privileges to SYSTEM, and urges a rapid patch, without providing a PoC, exploit code, or evidence of active exploitation.
0000049
1.2K followersView on X

CPE platform detail16 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

16 of 16 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_21h2 vulnerabilities

What researchers are saying

CVE-2026-42904

Horizon Secured[verified]@horizon_securedGeneral

The post announces a set of new zero-day CVEs for June 2026, listing their IDs, severity scores, and general impact types, but provides no PoC, exploit code, patch, or evidence of active exploitation.

IntegSec[verified]@integ_secGeneral

The text only mentions a new Windows TCP/IP heap buffer overflow CVE, providing its type but not any PoC, exploit, patch, or active exploitation details.

ゆぅさん[verified]@YY20424277General

The note offers a structured background/ purpose/ effect analysis of the CVE‑2026‑42904 heap‑buffer overflow in Windows 10 21h2, without providing PoC, exploit, or patch details.

WindowsForum[verified]@windowsforumDisclosure

The tweet announces CVE‑2026‑42904, a TCP/IP heap overflow that elevates privileges to SYSTEM, and urges a rapid patch, without providing a PoC, exploit code, or evidence of active exploitation.