A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.
Why was the Exploitability Index rating for this vulnerability lowered from “1 - Exploitation More Likely” to “2 – Exploitation Less Likely”? The presence of exploit mitigations (specifically /GS (Buffer Security Check)) makes it extremely difficult to exploit this issue for code execution. Why is the CVSS score for this vulnerability being reduced from 9.8 to 8.8? The CVSS score was lowered because the vulnerability is not routable over the internet, so we changed the AV score to Adjacent.
Maturity: Exploit
Microsoft Platform Security Assurance & Vulnerability Research