Windows TCP/IP CVE-2026-40401

Requires local access to the affected Windows host: the attacker must be able to execute code on the machine (interactive session, local shell, or an existing low-privileged foothold), as reflected by AV:L. No authentication or privileges are needed beyond that access (PR:N) and no user interaction is required (UI:N), so any unprivileged local user can trigger it against a default, unpatched Windows install. What limits exploitation is the absence of any remote/network vector - it cannot be triggered across the network - and the impact is confined to denial of service (system crash) with no path to code execution or data disclosure.

Signals are consistent and point to a moderate, low-urgency issue. The CVSS 3.1 base of 7.1 is driven entirely by the availability impact (A:H) plus scope change (S:C); confidentiality and integrity are untouched (C:N/I:N). The attack vector is local (AV:L) with low complexity and no privileges or user interaction (AC:L/PR:N/UI:N), meaning an already-present unprivileged local actor can trigger it reliably, but it is not remotely reachable. EPSS is very low at 0.05% (16th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial - no active exploitation and only partial impact. SSVC does flag Automatable: yes, meaning the trigger could be scripted, but combined with the local-only vector this favors nuisance/insider or post-compromise stability abuse rather than mass exploitation. This is a patch-in-normal-cycle item, not an emergency: real but not a priority-zero threat.

An attacker who already has unprivileged local access to a Windows host - for example a standard domain user on a shared terminal server or an attacker who has gained an initial low-privileged foothold - runs code that exercises the vulnerable TCP/IP code path, dereferencing a null pointer in the kernel. The resulting bugcheck crashes the machine, denying service to all users on that host; no public exploit code has been identified at time of analysis.