# CVE-2026-58532 — Windows `tcpip.sys` ALE Redirect Records Integer Overflow (`count * 0x228` wraps) → OOB Deserialization → EoP --- ## Summary | **Product** | Microsoft Windows — `tcpip.sys` (TCP/IP kernel driver, WFP ALE path) | |-----------------------|-----------------------------------------------------------------------| | **Vendor** | Microsoft Corporation | | **Severity** | High | | **Affected Versions** | Per MSRC/NVD: Windows 10 1607→22H2, Windows 11 24H2/25H2/26H1, Windows Server 2012→2025 — before the July 2026 security updates (Win11 24H2 fixed at 10.0.26100.8875) | | **Tested Version** | Windows 11 24H2 — tcpip.sys 10.0.26100.8737 (pre-patch) vs 10.0.26100.8875 (post-patch, KB5101650) | | **Impact** | Elevation of Privilege — integer overflow in kernel deserializer → OOB read/write | | **CVE ID** | CVE-2026-58532 | | **CWE** | CWE-190 (Integer Overflow/Wraparound) — Microsoft's classification per NVD. CWE-125/CWE-787 (OOB read/write) is an analyst inference from the post-overflow behavior | | **Vulnerable function** | `tcpip!AleRedirectRecordsDeserializeFromBuffer` | | **Reachability** | `WSAIoctl(sock, SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS, ...)` — `0x980000DE` | | **PoC Available** | Yes (aprilpet public disclosure PoC; blue-team version below) | | **Patch Available** | Yes — July 2026 (KB5101650 on Win11 24H2) | --- ## CVSS 3.1 Detailed Scoring **Base Score:** 7.8 (HIGH) — Microsoft-assigned, as published in NVD (source `secure@microsoft.com`) **Vector String:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (matches Microsoft's published vector) | **Metric** | **Value** | **Rationale** | |---|---|---| | **Attack Vector (AV)** | Local | Requires a local Winsock socket | | **Attack Complexity (AC)** | Low | Single 16-byte buffer; fully deterministic trigger | | **Privileges Required (PR)** | Low | Standard user can create sockets and set WFP redirect records | | **User Interaction (UI)** | None | — | | **C/I/A** | High | Kernel OOB read/write in a deserializer; EoP classified by MSRC | --- ## Product Description `tcpip.sys` implements the Windows TCP/IP stack and hosts the Windows Filtering Platform (WFP) Application Layer Enforcement (ALE) logic. ALE **connection redirect records** let Winsock clients attach redirection state to a socket via the socket control operation `SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS` (`0x980000DE`), passed through `WSAIoctl`. The input format is: a 64-bit record count, followed by that many serialized redirect records of `0x228` bytes each. --- ## Vulnerability Summary The deserializer bounds-checks the buffer with an **unchecked unsigned 64-bit multiplication**: ```c uint64_t recordCount = *(uint64_t *)input; // fully user-controlled if (recordCount * 0x228 > remainingLength) // <- no overflow check return STATUS_INVALID_PARAMETER; ``` Choosing `recordCount = 0x2000000000000000` makes the product wrap: ``` 0x2000000000000000 * 0x228 = 0x45 * 2^64 ≡ 0 (mod 2^64) ``` `0 <= remainingLength` passes for any buffer size. The processing loop then: ```c while (recordCount != 0) { record = allocate_pool(0x228, 'AlcR'); copy_memory(record, input, 0x228); // 1st copy reads OOB input += 0x228; remainingLength -= 0x228; // underflows recordCount--; variableLength = *(uint32_t *)(record + 0x1e8); // drives further /* more allocation/copy work from the fake record */ // allocations } ``` The first copy reads past the input; after `remainingLength` underflows, every subsequent bounds check operates on ~`ULONGLONG_MAX`. The deserialized record's variable-length field at `+0x1e8` then drives additional allocation and copy operations from attacker-influenced data — an EoP-grade primitive (Microsoft classified the CVE as Elevation of Privilege). Notably, the matching **serializer** used checked arithmetic; the deserializer didn't. The fix uses a division-form or checked bound: ```c if (count > remainingLength / 0x228) return STATUS_INVALID_PARAMETER; ``` --- ## Prerequisites and Constraints - Local authenticated session, standard user - Ability to create a TCP socket (`WSASocketW`, AF_INET or AF_INET6) - `SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS` reachable without admin - No race condition; single `WSAIoctl` call triggers it --- ## Vulnerability Details ### Reaching the bug from userspace (the "hint") | Interface | Role | |---|---| | `WSASocketW(AF_INET/AF_INET6, SOCK_STREAM, IPPROTO_TCP)` | create the socket | | `WSAIoctl(sock, 0x980000DE, buf, len, ...)` | **the trigger** — `SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS` | | Input buffer layout | `+0x00 u64 recordCount` (attacker), then `recordCount × 0x228`-byte records | ### Complete kernel call flow ``` User mode: WS2_32!WSAIoctl(sock, SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS, buf, 16, ...) │ ▼ Kernel mode: afd!AfdTLIoControl .............................. AFD transport ioctl path → tcpip!TcpSetSockOptEndpoint ................. socket option endpoint handler → tcpip!InetInspectSocketOption ............. option inspection (+0x60) → tcpip!WfpAleProcessSocketOption ......... WFP ALE option processing (+0x273) → tcpip!AleRedirectRecordsDeserializeFromBuffer [*** BUG @ +0x18d ***] count = *(u64*)input // 0x2000000000000000 if (count * 0x228 > remaining) fail // wraps to 0 → passes loop: ExAllocatePool('AlcR', 0x228) memcpy(record, input, 0x228) // OOB read of input remaining -= 0x228 // underflows variableLength = record+0x1e8 // drives more allocs (cleanup path later faults in tcpip!WfpAleDecrementWaitRef) ``` ### The patch (ghidriff-verified) The deserializer (`0x14011eff4 → 0x14013f8bc`, 578 → 685 bytes, ratio 0.33) gains a checked multiply gated by WIL flag **`Feature_1204007226`**: ```c // post-patch — actual ghidriff decompilation (abridged) if (param_2 < 8) goto REPORT_ERROR; // new min-length gate count = *param_1; remaining = param_2 - 8; if (Feature_1204007226__private_IsEnabledDeviceUsageNoInline()) { if (WfpSizeTMultiply(count, 0x228, &total) != 0) // checked multiply goto FAIL; if (count != 0 && total > remaining) goto REPORT_ERROR; } else if (count == 0 || remaining < count * 0x228) { // legacy path (flag off) goto REPORT_ERROR; } for (i = 0; i < count; i++) { if (flag_on && remaining < 0x228) goto REPORT_ERROR; // per-iteration check ... } ``` The wrapped product now fails the `total <= remaining` comparison, so the 16-byte PoC buffer is rejected before any record is allocated. Error reporting also moved from `WfpReportSysErrorAsNtStatus` to `WfpReportAppErrorAsNtStatus` + `WfpReportError`. --- ## Exploitation Scenario No public full exploit; CISA's SSVC assessment recorded exploitation as "none" at disclosure (2026-07-14). The author's PoC demonstrates the crash: after the wrapped bounds check, the deserializer pool-allocates (`'AlcR'` tag) and copies non-existent records, underflows `remainingLength`, and consumes a variable-length field at record `+0x1e8` for further allocation/copy work. MSRC classified the issue as Elevation of Privilege; a full chain would shape the pool around the `AlcR` allocations and use the OOB copy/variable length handling for controlled kernel corruption. --- ## Trigger PoC See [`poc/poc_cve_2026_58532.c`](/data/patch_diffs/poc/poc_cve_2026_58532.c) — based on aprilpet's disclosure PoC. One socket, one 16-byte buffer, `recordCount = 0x2000000000000000`: - **Pre-patch VM:** bug check (observed via `tcpip!WfpAleDecrementWaitRef` cleanup after the malformed input is processed). Snapshotted VM only. - **Patched:** `WSAIoctl` fails with an error; no crash. --- ## Detection Rules ### YARA — PoC binaries ```yara rule CVE_2026_58532_TCPIP_ALE_Overflow_PoC { meta: description = "Detects CVE-2026-58532 tcpip.sys ALE redirect-records overflow PoC" author = "OnlyFm252" date = "2026-07-19" cve = "CVE-2026-58532" tlp = "white" strings: $ioctl = { DE 00 00 98 } // 0x980000DE little-endian $count = { 00 00 00 00 00 00 00 20 } // 0x2000000000000000 $api1 = "WSAIoctl" ascii $api2 = "WSASocketW" ascii condition: uint16(0) == 0x5A4D and filesize < 1MB and $ioctl and $count and ($api1 or $api2) } ``` ### Sigma — WFP redirect-records socket option usage ```yaml title: WFP Connection Redirect Records Socket Option (CVE-2026-58532) id: 6c4d8e02-5853-2cde-7ab1-202607080003 status: experimental description: > Detects use of the SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS socket control operation (0x980000DE), the trigger path for CVE-2026-58532. This option is rarely used outside WFP-aware security products. author: OnlyFm252 date: 2026/07/19 references: - https://aprl.pet/writing/cve-2026-58532 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - 'SIO_SET_WFP_CONNECTION_REDIRECT_RECORDS' - '0x980000DE' condition: selection falsepositives: - WFP-aware security/EDR products configuring redirection level: medium tags: - attack.privilege_escalation - attack.t1068 - cve.2026.58532 ``` ### Sigma — tcpip.sys bugcheck after socket activity ```yaml title: TCPIP Bugcheck Referencing ALE Redirect Records (CVE-2026-58532) id: 7d5e9f13-5853-3def-6bc2-202607080004 status: experimental description: > Correlates system bugcheck events (WER SystemErrorReporting, Event ID 1001) referencing tcpip.sys with the crash signature of a CVE-2026-58532 trigger attempt. Note: raw bugcheck events name the faulting module (tcpip.sys) but not function symbols; the AleRedirectRecords / WfpAleDecrementWaitRef keywords only match when symbolized crash-dump text is ingested alongside. author: OnlyFm252 date: 2026/07/19 logsource: product: windows service: system detection: selection: EventID: 1001 Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting' keywords: - 'tcpip.sys' - 'AleRedirectRecords' - 'WfpAleDecrementWaitRef' condition: selection and keywords level: critical tags: - attack.privilege_escalation - attack.t1068 - cve.2026.58532 ``` ### Sysmon configuration ```xml 980000DE ws2_32.dll C:\Users\ \AppData\Local\Temp\ ``` --- ## Remediation 1. **Apply KB5101650** (July 2026) or later. Verify `tcpip.sys ≥ 10.0.26100.8875`. 2. **Hunt** bugchecks referencing `AleRedirectRecordsDeserializeFromBuffer` or `WfpAleDecrementWaitRef` on pre-patch builds. 3. **Deploy the detections above**; the magic count `0x2000000000000000` + IOCTL `0x980000DE` byte pair is a strong static signature for PoC variants. 4. **Note for developers:** the serializer in the same driver used checked arithmetic — audit *both* directions of any size computation. --- ## Timeline | Date | Event | |---|---| | 2026-04-20 | aprilpet reports the bug to MSRC | | 2026-07-14 | Microsoft July 2026 Patch Tuesday (KB5101650) — CVE-2026-58532 published, EoP (NVD record published 2026-07-14) | | 2026-07-19 | This analysis: blue-team package; fix verified locally via ghidriff + Ghidra decompilation | --- ## References - [aprilpet — CVE-2026-58532 writeup](https://aprl.pet/writing/cve-2026-58532) - [MSRC — CVE-2026-58532](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58532) - [NVD — CVE-2026-58532](https://nvd.nist.gov/vuln/detail/CVE-2026-58532) (Microsoft-assigned CVSS 7.8 / CWE-190; affected-version ranges) - [OnlyFm252 diff report — tcpip_sys-kb5101650](/data/patch_diffs/tcpip_sys-kb5101650.md) ---