EUVD-2026-29670
GHSA-jf9h-cjw5-p35f
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Adjacent-only crafted packets with no auth or interaction (AV:A/AC:L/PR:N/UI:N) cause a kernel crash affecting the whole system (S:C, A:H) with no data impact (C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.
AnalysisAI
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Windows TCP/IP kernel networking stack (tcpip.sys), the core driver that parses and processes IPv4/IPv6 and transport-layer packets for every modern Windows client and server. CWE-476 (NULL Pointer Dereference) indicates that a specific malformed or unexpected packet sequence drives the driver down a code path where a pointer is used without being validated as non-null, causing an unhandled kernel fault (bugcheck/BSOD). Because the fault occurs in ring-0 kernel code, the result is a full system crash rather than a single-process failure. The CPE set (microsoft:windows_10 versions 1607/1809/21H2/22H2, windows_11 22H3/23H2/24H2/25H2/26H1, and windows_server_2012) plus the broader EUVD list confirm the defect is in shared networking code common to the entire supported Windows line, not a single edition.
RemediationAI
Vendor-released patch: apply the Microsoft security update for your specific Windows build via Windows Update or WSUS, upgrading tcpip.sys to at least the fixed build for your edition (for example 10.0.19045.7291 for Windows 10 22H2, 10.0.26100.8457 for Windows 11 24H2, 10.0.20348.5139 for Windows Server 2022, and 10.0.26100.32860 for Windows Server 2025), as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40413. Patching is the definitive fix; there is no software-side toggle to disable the vulnerable parser. As a compensating control until patching is complete, exploit the AV:A limitation: segment and restrict layer-2/adjacent access so only trusted hosts share a subnet with critical servers, enforce switch-level port security and ACLs, and place management interfaces on isolated VLANs - the trade-off is added network administration overhead and no protection against an already-compromised on-segment host. Host-based firewalls offer limited help here because the flaw is in core stack packet processing rather than a specific closable service port.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today