Threat Brief: Windows IPv4 and IPv6 Stack Vulnerabilities (CVE-2021-24074, CVE-2021-24086 and CVE-2021-24094)
Summary: Microsoft's February 2021 Patch Tuesday covered 56 disclosed vulnerabilities, including CVE-2021-24086 (CVSS 7.5/6.5, rated Important) and CVE-2021-24094 and CVE-2021-24074 (CVSS 9.8/8.4, rated Critical). Crafted IPv6 packets with multiple, invalid or nested fragment headers cause a denial-of-service condition, while CVE-2021-24074 exploits confusion of IPv4 options fields between two fragments - a Security Options field followed by a Loose or Strict Source Routing option - to trigger an out-of-bound read and write during reassembly with the potential for remote code execution.
Key Takeaway: A CVSS score of 9.8 on a flaw in the Windows TCP/IP stack means an attacker who reaches an unpatched host with crafted IPv4 fragments may get code execution, not just a crash - and Palo Alto notes that allowing source-routing options lets adversaries bypass security policy rules that match on destination IP address.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-24074CVE-2021-24086CVE-2021-24094
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026