TALOS-2026-2427
CVE-2026-49177
An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet (IRP) can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
TCP/IP Driver (version(s): 10.0.26100.8457)
TCP/IP Driver - https://www.microsoft.com/
8.4 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Windows tcpip.sys is a core kernel-mode networking driver that implements major parts of the IPv4/IPv6 TCP/IP stack, including IP, TCP, UDP, ICMP, routing, and packet handling logic. It works with NDIS miniport drivers, filter drivers, WFP, Winsock/AFD, and other networking components to move network traffic between applications and network adapters.
When a specially crafted IRP request is sent to the handler for the 0x120007 IOCTL, it invokes the IpGetAllSortedAddressParameters function.
fffff8055387cf20 uint64_t IpGetAllSortedAddressParameters(void* arg1)
fffff8055387cf20 {
fffff8055387cf20 int32_t* KeyBuffer = *(uint64_t*)((char*)arg1 + 0x10); //<---------- (1)
fffff8055387cf3a uint128_t* rsi = *(uint64_t*)((char*)arg1 + 0x38);
fffff8055387cf3a
fffff8055387cf3e if (!Ipv6Global)
fffff8055387cf63 return 0xc00000bb;
fffff8055387cf63
[...]
fffff8055387cffb if (!*(uint32_t*)KeyBuffer || rax_5)
fffff8055387cffb {
fffff8055387cf93 memset(rsi, 0, 0x4658);
fffff8055387cfdb rbx = IppCreateSortedAddressPairsEx(rax_1, KeyBuffer[0xdae], rsi,
fffff8055387cfdb &rsi[0x36b], &KeyBuffer[1], KeyBuffer[0xdad],
fffff8055387cfdb (char*)rsi + 0x36b4, (char*)rsi + 0x4654); //<-------------- (2)
fffff8055387cffb }
At (1), the user-controlled input buffer, KeyBuffer, is read. The size of KeyBuffer is 0x36bc bytes. Later, at (2), the IppCreateSortedAddressPairsEx function is called. The second, fourth, and fifth arguments are derived from the KeyBuffer buffer. For this vulnerability, the fifth argument, MaxDestCount, is important.
fffff8055387d075 int32_t MaxDestCount_1 = MaxDestCount;
fffff8055387d079 int64_t P_2 = 0;
fffff8055387d07d *(uint32_t*)arg4 = 0;
fffff8055387d083 int32_t rbx;
fffff8055387d083
fffff8055387d083 if (!MaxDestCount) //<-------------- (3)
fffff8055387d120 rbx = 0;
fffff8055387d083 else
fffff8055387d083 {
fffff8055387d092 int64_t* rax_1 = IppFindCompartmentById(&Ipv4Global, *(uint32_t*)rdi);
fffff8055387d0a9 rsi = rax_1;
fffff8055387d0ac IppQualifyAddresses(rdi, &MaxDestCount_1, keybuf_off4, nullptr); //<-------------- (4)
fffff8055387d0bf int32_t rax_2;
In IppCreateSortedAddressPairsEx, if MaxDestCount is non-zero, then IppQualifyAddresses is called at (4) to filter the destination addresses. The KeyBuffer pointer is incremented by 4 bytes and passed to the IppQualifyAddresses function.
fffff8055387d800 int32_t* IppQualifyAddresses(int64_t* arg1, int32_t* MaxDestCount,
fffff8055387d800 void* keybuf_off4, void* const arg4)
fffff8055387d800 {
fffff8055387d800 int32_t* result = MaxDestCount;
fffff8055387d821 uint64_t MaxDestCount_1 = (uint64_t)*(uint32_t*)MaxDestCount;
[...]
fffff8055387d83b
fffff8055387d841 if ((uint32_t)MaxDestCount_1)
fffff8055387d841 {
fffff8055387d843 char* r8 = (char*)keybuf_off4 + 9;
fffff8055387d843
fffff8055387d871 do //<-------------- (5)
fffff8055387d871 {
fffff8055387d850 char rcx = r8[-1];
fffff8055387d850
fffff8055387d858 if (rcx == 0xfe)
fffff8055387d858 {
fffff8055387d912 if ((*(uint8_t*)r8 & 0xc0) != 0xc0)
fffff8055387d912 {
fffff8055387d97d if (rcx == 0xfe && (*(uint8_t*)r8 & 0xc0) == 0x80)
fffff8055387d97d {
fffff8055387d987 r15 = (uint64_t)(uint8_t)r15;
fffff8055387d987
[...]
fffff8055387d858 }
fffff8055387d858
fffff8055387d867 i += 1;
fffff8055387d86a r8 = &r8[0x1c];
fffff8055387d871 } while (i < (uint32_t)MaxDestCount_1); //<-------------- (6)
fffff8055387d841 }
fffff8055387d841
The vulnerability occurs in IppQualifyAddresses. In IppQualifyAddresses, a loop starts at (5) and runs MaxDestCount times. It first increments KeyBuffer by 0x8, and in each iteration, KeyBuffer is increased by 0x1c. Therefore, if the value of MaxDestCount is greater than (0x36bc - 4 - 8) // 0x1c = 0x1f4, an out-of-bounds read occurs.
This can be observed while debugging the machine with WinDbg:
: kd> g
Breakpoint 0 hit
tcpip!IppQualifyAddresses+0x21:
fffff807`24b2d821 448b32 mov r14d,dword ptr [rdx]
1: kd> r
rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=ffffe40dc14898a0
rdx=ffffce0b5f3a6c18 rsi=ffffe40dc14878a0 rdi=ffffe40dc14898a0
rip=fffff80724b2d821 rsp=ffffce0b5f3a6b80 rbp=ffffce0b5f3a6c48
r8=ffffe40dc4b1e06c r9=0000000000000000 r10=fffff80790ff9690
r11=ffffce0b5f3a6cc0 r12=0000000000000000 r13=00000000bbbbbbbb
r14=0000000000000000 r15=fffff80724c963d8
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040282
tcpip!IppQualifyAddresses+0x21:
fffff807`24b2d821 448b32 mov r14d,dword ptr [rdx] ds:002b:ffffce0b`5f3a6c18=bbbbbbbb;<--------- (7)
1: kd> p
tcpip!IppQualifyAddresses+0x24:
fffff807`24b2d824 33f6 xor esi,esi
1: kd> p
tcpip!IppQualifyAddresses+0x26:
fffff807`24b2d826 8b3d7c861200 mov edi,dword ptr [tcpip!scopeid_unspecified (fffff807`24c55ea8)]
1: kd> p
tcpip!IppQualifyAddresses+0x2c:
fffff807`24b2d82c 498be9 mov rbp,r9
1: kd> p
tcpip!IppQualifyAddresses+0x2f:
fffff807`24b2d82f 4532c9 xor r9b,r9b
1: kd> p
tcpip!IppQualifyAddresses+0x32:
fffff807`24b2d832 4532ff xor r15b,r15b
1: kd> p
tcpip!IppQualifyAddresses+0x35:
fffff807`24b2d835 4d8be8 mov r13,r8
1: kd> p
tcpip!IppQualifyAddresses+0x38:
fffff807`24b2d838 4c8be1 mov r12,rcx
1: kd> p
tcpip!IppQualifyAddresses+0x3b:
fffff807`24b2d83b 448bd6 mov r10d,esi
1: kd> p
tcpip!IppQualifyAddresses+0x3e:
fffff807`24b2d83e 4585f6 test r14d,r14d
1: kd> p
tcpip!IppQualifyAddresses+0x41:
fffff807`24b2d841 7430 je tcpip!IppQualifyAddresses+0x73 (fffff807`24b2d873)
1: kd> p
tcpip!IppQualifyAddresses+0x43:
fffff807`24b2d843 4983c009 add r8,9
1: kd> p
tcpip!IppQualifyAddresses+0x47:
fffff807`24b2d847 448d5e01 lea r11d,[rsi+1]
1: kd> p
tcpip!IppQualifyAddresses+0x4b:
fffff807`24b2d84b 0f1f440000 nop dword ptr [rax+rax]
1: kd> p
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
1: kd> r
rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=ffffe40dc14898a0
rdx=ffffce0b5f3a6c18 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80724b2d850 rsp=ffffce0b5f3a6b80 rbp=0000000000000000
r8=ffffe40dc4b1e075 r9=0000000000000000 r10=0000000000000000
r11=0000000000000001 r12=ffffe40dc14898a0 r13=ffffe40dc4b1e06c
r14=00000000bbbbbbbb r15=fffff80724c96300
iopl=0 nv up ei ng nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040292
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1] ds:002b:ffffe40d`c4b1e074=00 ; <------------- (8)
1: kd> db r8-c
ffffe40d`c4b1e069 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e079 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e089 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e099 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e0a9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e0b9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e0c9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffe40d`c4b1e0d9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
1: kd> bp
1: kd> g
Breakpoint 1 hit
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
1: kd> g
Breakpoint 1 hit
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
1: kd> r
rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=0000000000000000
rdx=ffffce0b5f3a6c18 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80724b2d850 rsp=ffffce0b5f3a6b80 rbp=0000000000000000
r8=ffffe40dc4b1e0ad r9=0000000000000000 r10=0000000000000002
r11=0000000000000001 r12=ffffe40dc14898a0 r13=ffffe40dc4b1e06c
r14=00000000bbbbbbbb r15=fffff80724c96300
iopl=0 nv up ei pl nz ac pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040217
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1] ds:002b:ffffe40d`c4b1e0ac=00
1: kd> u
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
fffff807`24b2d855 80f9fe cmp cl,0FEh
fffff807`24b2d858 0f84ac000000 je tcpip!IppQualifyAddresses+0x10a (fffff807`24b2d90a)
fffff807`24b2d85e 4584c9 test r9b,r9b
fffff807`24b2d861 0f85bb000000 jne tcpip!IppQualifyAddresses+0x122 (fffff807`24b2d922)
fffff807`24b2d867 41ffc2 inc r10d
fffff807`24b2d86a 4983c01c add r8,1Ch
fffff807`24b2d86e 453bd6 cmp r10d,r14d
1: kd> g
Breakpoint 1 hit
tcpip!IppQualifyAddresses+0x50:
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
In this case, the value of MaxDestCount is 0xbbbbbbbb, which can be observed at (7). The loop reads KeyBuffer at (8). Here, MaxDestCount is greater than 0x1f4, so if the loop continues, the following crash can be observed:
1: kd> g
KDTARGET: Refreshing KD connection
*** Fatal System Error: 0x00000050
(0xFFFFE40DC4B23014,0x0000000000000000,0xFFFFF80724B2D850,0x0000000000000002)
Driver at fault:
*** tcpip.sys - Address FFFFF80724B2D850 base at FFFFF80724A70000, DateStamp 3fc564c3
.
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
nt!DbgBreakPointWithStatus:
fffff807`910f92d0 cc int 3
1: kd> !analyze -v -a
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe40dc4b23014, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80724b2d850, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
KEY_VALUES_STRING: 1
Key : AV.PTE
Value: Invalid
Key : AV.Page.Virtual
Value: 0xffffe40dc4b20000
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 20421
Key : Analysis.Elapsed.mSec
Value: 71615
Key : Analysis.IO.Other.Mb
Value: 92
Key : Analysis.IO.Read.Mb
Value: 34
Key : Analysis.IO.Write.Mb
Value: 125
Key : Analysis.Init.CPU.mSec
Value: 572390
Key : Analysis.Init.Elapsed.mSec
Value: 109313545
Key : Analysis.Memory.CommitPeak.Mb
Value: 255
Key : Analysis.Version.DbgEng
Value: 10.0.29547.1002
Key : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre
Key : Analysis.Version.Ext
Value: 1.2602.27.2
Key : Bugcheck.Code.KiBugCheckData
Value: 0x50
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Bugcheck.Code.TargetModel
Value: 0x50
Key : Failure.Bucket
Value: AV_NETIO!NsiGetParameterEx
Key : Failure.Exception.IP.Address
Value: 0xfffff80724b2d850
Key : Failure.Exception.IP.Module
Value: tcpip
Key : Failure.Exception.IP.Offset
Value: 0xbd850
Key : Failure.Hash
Value: {144d820d-4433-7015-42ee-2ff721fb50d9}
Key : Faulting.IP.Type
Value: Paged
Key : Hypervisor.Enlightenments.Value
Value: 12576
Key : Hypervisor.Enlightenments.ValueHex
Value: 0x3120
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1
Key : Hypervisor.Flags.ApicEnlightened
Value: 0
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 0
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 0
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 0
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 1
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 1
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 1
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 536632
Key : Hypervisor.Flags.ValueHex
Value: 0x83038
Key : Hypervisor.Flags.VpAssistPage
Value: 1
Key : Hypervisor.Flags.VsmAvailable
Value: 0
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0x0
Key : SecureKernel.HalpHvciEnabled
Value: 0
Key : WER.OS.Branch
Value: ge_release
Key : WER.OS.Version
Value: 10.0.26100.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffe40dc4b23014
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80724b2d850
BUGCHECK_P4: 2
FAULTING_THREAD: ffffe40dc4bc6080
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffe40dc4b23014
READ_ADDRESS: ffffe40dc4b23014 Nonpaged pool
MM_INTERNAL_CODE: 2
PROCESS_NAME: poc.exe
IP_IN_PAGED_CODE:
tcpip!IppQualifyAddresses+50
fffff807`24b2d850 410fb648ff movzx ecx,byte ptr [r8-1]
STACK_TEXT:
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
ffffce0b`5f3a5f58 fffff807`911afa92 : ffffce0b`5f3a5fd8 00000000`00000001 00000000`00000080 fffff807`912c2a01 : nt!DbgBreakPointWithStatus
ffffce0b`5f3a5f60 fffff807`911aefbe : 00000000`00000003 ffffce0b`5f3a60c0 fffff807`912c2c90 ffffce0b`5f3a6680 : nt!KiBugCheckDebugBreak+0x12
ffffce0b`5f3a5fc0 fffff807`910f8557 : 00000000`00000000 fffff807`90f0caf2 ffffe40d`c4b23014 00000000`00000000 : nt!KeBugCheck2+0xb2e
ffffce0b`5f3a6750 fffff807`90f0e960 : 00000000`00000050 ffffe40d`c4b23014 00000000`00000000 ffffce0b`5f3a69f0 : nt!KeBugCheckEx+0x107
ffffce0b`5f3a6790 fffff807`90e43e96 : 00000000`00000000 ffff8000`00000000 ffffe40d`c4b23014 0000007f`fffffff8 : nt!MiSystemFault+0x850
ffffce0b`5f3a6880 fffff807`912b80cb : 004e005c`00000000 00000000`00000006 00000000`00000000 ffffce0b`5f3a6a70 : nt!MmAccessFault+0x646
ffffce0b`5f3a69f0 fffff807`24b2d850 : 00000000`00000015 ffffce0b`5f3a74a0 fffff807`249d4d60 00000000`00000015 : nt!KiPageFault+0x38b
ffffce0b`5f3a6b80 fffff807`24b2d0b1 : ffffe40d`c4b1e068 ffffce0b`5f3a6c18 ffffce0b`5f3a6c48 ffffe40d`c14878a0 : tcpip!IppQualifyAddresses+0x50
ffffce0b`5f3a6bd0 fffff807`24b2cfdb : ffffe40d`c14898a0 ffffce0b`000000aa ffffe40d`c4b19000 ffffe40d`c4b1c6b0 : tcpip!IppCreateSortedAddressPairsEx+0x91
ffffce0b`5f3a6c90 fffff807`2496be03 : 00000000`00004658 00000000`00004658 00000000`00004658 ffffe40d`c4b1e000 : tcpip!IpGetAllSortedAddressParameters+0xbb
ffffce0b`5f3a6ce0 fffff807`25b32faa : 000001f1`0e2b5fd0 ffffe40d`c4b1e000 00000000`00000000 000001f1`0e2b5fd0 : NETIO!NsiGetParameterEx+0x603
ffffce0b`5f3a6e50 fffff807`25b32968 : 00000000`00000000 ffffe40d`c3189440 ffffe40d`c3189370 000001f1`0e2b5fd0 : nsiproxy!NsippGetParameter+0x2aa
ffffce0b`5f3a6fe0 fffff807`90e5ccfb : ffffce0b`5f3a7110 00000000`00000002 00000000`00000000 00000000`00000001 : nsiproxy!NsippDispatch+0xd8
ffffce0b`5f3a7030 fffff807`90e5cc73 : ffffce0b`5f3a70b0 ffffe40d`c4bc6910 00000000`00000000 ffffe40d`c4bc6958 : nt!IopfCallDriver+0x5b
ffffce0b`5f3a7070 fffff807`914cb3a5 : ffffe40d`c5e258d0 ffffce0b`5f3a7110 ffffe40d`c1795060 00000000`00000000 : nt!IofCallDriver+0x13
ffffce0b`5f3a70a0 fffff807`914ca1ec : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffce0b`5f3a7150 fffff807`914c983e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffce0b`5f3a73c0 fffff807`912bc555 : 00000000`00000001 000000a7`b08fa4c0 ffffce0b`5f3a7520 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffce0b`5f3a7430 00007ff8`ea141d84 : 00007ff8`e7635c43 000000a7`b08fc038 000000a7`b08fc040 000000a7`b08fc048 : nt!KiSystemServiceCopyEnd+0x25
000000a7`b08fbfe8 00007ff8`e7635c43 : 000000a7`b08fc038 000000a7`b08fc040 000000a7`b08fc048 0000df38`66e83860 : ntdll!NtDeviceIoControlFile+0x14
000000a7`b08fbff0 00007ff8`e7d83335 : 00000000`00120007 00007ff6`63571531 00007ff6`63591298 00007ff6`63591128 : KERNELBASE!DeviceIoControl+0x73
000000a7`b08fc060 00007ff6`63571424 : 000001f1`0e2b0020 000001f1`0e040000 00000000`00000000 00000000`00000000 : KERNEL32!DeviceIoControlImplementation+0x75
000000a7`b08fc0b0 000001f1`0e2b0020 : 000001f1`0e040000 00000000`00000000 00000000`00000000 00000000`00000000 : poc+0x1424
000000a7`b08fc0b8 000001f1`0e040000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000001f1`0e2b0020
000000a7`b08fc0c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 000000a7`b08fc118 : 0x000001f1`0e040000
SYMBOL_NAME: NETIO!NsiGetParameterEx+603
MODULE_NAME: NETIO
IMAGE_NAME: NETIO.SYS
STACK_COMMAND: .process /r /p 0xffffe40dc4ac3080; .thread /r /p 0xffffe40dc4bc6080 ; kb
BUCKET_ID_FUNC_OFFSET: 603
FAILURE_BUCKET_ID: AV_NETIO!NsiGetParameterEx
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {144d820d-4433-7015-42ee-2ff721fb50d9}
Followup: MachineOwner
---------
kd>lmDvm tcpip
Browse full module list
start end module name
fffff807`24a70000 fffff807`24dc9000 tcpip (pdb symbols) C:\ProgramData\Dbg\sym\tcpip.pdb\D6947ED1ADE91B23FA5AFE8178A2AF0F1\tcpip.pdb
Loaded symbol image file: tcpip.sys
Image path: \SystemRoot\System32\drivers\tcpip.sys
Image name: tcpip.sys
Browse all global symbols functions data Symbol Reload
Image was built with /Brepro flag.
Timestamp: 3FC564C3 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00354B4C
ImageSize: 00359000
Mapping Form: Loaded
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Vendor Link: https://windowsforum.com/security-alerts.84/cve-2026-49177-july-14-updates-fix-windows-tcp-ip-data-leak.438177/
2026-06-01 - Vendor Disclosure
2026-07-14 - Vendor Patch Release
KPC of Cisco Talos