What is the CVSS score of CVE-2026-40414?

CVE-2026-40414 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows TCP/IP are affected by CVE-2026-40414?

A high-severity Windows TCP/IP vulnerability (CVE-2026-40414, CVSS 7.4) affecting Windows 10 through Windows 11 and Server editions 2012-2025 allows unauthenticated adjacent-network attackers to…. A patch is available.

How to fix or mitigate CVE-2026-40414?

Within 24 hours: Identify and categorize all affected Windows systems-Windows 10 (1607 and later), Windows 11, and Server editions 2012 through 2025-using your CMDB and asset management tools, prioritizing internet-facing and Server infrastructure. Within 7 days: Obtain and test the vendor-released patch in an isolated lab environment against representative production workloads to validate compatibility. Within 30 days: Execute staged patch deployment across production, beginning with internet-facing servers and DMZ systems, proceeding to internal servers and data centers, and completing with Windows 10/11 client devices.

Windows TCP/IP CVE-2026-40414

EUVD-2026-29671 HIGH

NULL Pointer Dereference (CWE-476)

2026-05-12 microsoft

GHSA-r58x-7f7v-85gg

Denial Of Service Null Pointer Dereference Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 22H3 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Adjacent unauthenticated packet triggers a kernel crash with no interaction, so AV:A/AC:L/PR:N/UI:N and A:H only; scope changes as the kernel bugcheck downs the whole host.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:58 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 7.4

DescriptionCVE.org

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.

AnalysisAI

Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.

Technical ContextAI

The vulnerability resides in the Windows TCP/IP stack (tcpip.sys), the kernel-mode driver responsible for parsing and handling IPv4/IPv6, TCP, UDP and related protocol traffic. The root cause is a CWE-476 null pointer dereference, meaning a specially crafted packet drives a code path that dereferences a pointer without validating it is non-null, faulting the kernel and forcing a bugcheck (BSOD). Because the code executes in kernel context, a crash takes down the entire operating system rather than a single process. The CPE set spans Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025, confirming the defect lives in shared core networking code common to all these releases.

RemediationAI

Apply the Microsoft security update for your specific Windows build; Vendor-released patch: install the cumulative update that brings each SKU to at least its fixed build (e.g., Windows 11 24H2 to 10.0.26100.8457, Windows 10 22H2 to 10.0.19045.7291, Server 2022 to 10.0.20348.5139, Server 2025 to 10.0.26100.32860) per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40414. Because the vector is adjacent-network (AV:A), effective compensating controls until patching include restricting layer-2/subnet adjacency to trusted hosts, segmenting untrusted or guest devices onto isolated VLANs, and enforcing host firewall and network ACLs to limit exposure of the affected system to unknown adjacent peers - with the trade-off that overly aggressive filtering of the relevant protocol traffic can disrupt legitimate connectivity. There is no confidentiality/integrity exposure, so the compensating goal is availability protection of the host until the update is deployed.