Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "T…

1. 2014-11-11 First public exploit (Metasploit exploit/windows/local/ms14_070_tcpip_ioctl)
2. 2014-11-11 Published

22.84% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/windows/local/ms14_070_tcpip_ioctl MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference metasploit exploit, average rank, 2014-11-11
• EDB-37755 Microsoft Windows Server 2003 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070) local, 2015-08-12
• EDB-35936 Microsoft Windows Server 2003 SP2 - Local Privilege Escalation (MS14-070) local, 2015-01-29

Weakness

• CWE-264 Permissions, Privileges, and Access Controls

• exploit-db.com /exploits/37755/

  exploit

• exploit-db.com /exploits/35936

  exploit

• docs.microsoft.com /en-us/security-updates/securitybulletins/2014/ms14-070

  vendor-advisory

• osvdb.org /114532

  vdb-entry

• securityfocus.com /bid/70976

  vdb-entry

• CVE List CVE-2014-4076
• NVD CVE-2014-4076

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.