EUVD-2026-73344
GHSA-95x5-r679-m6mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify SMB-exposed Windows target on TCP 445
-
DeliveryCraft malformed SMB packet to trigger null dereference
-
ExploitSend packet to srvnet.sys pre-authentication
-
ExecutionNull pointer dereference in kernel driver
-
PersistKernel crash / BSOD
-
ImpactSystem reboots, services disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability to the Windows SMB service on TCP 445. The CVSS vector PR:N/AC:L/UI:N/AV:N confirms unauthenticated, low-complexity, remote exploitation against default-enabled SMB services. Exploitation is limited by network access controls: environments where TCP 445 is blocked at the perimeter or host firewall are not reachable. Only the specific Windows builds listed in affected versions are vulnerable; systems fully patched to the corrected build numbers are not affected. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat model: low-complexity, unauthenticated, remotely triggerable availability impact with no confidentiality or integrity consequence. For publicly reachable SMB services - particularly Windows Server instances with TCP 445 exposed to untrusted networks - this is a meaningful operational risk, as a successful crash disrupts file sharing, domain authentication (NTLM/Kerberos over SMB), and other dependent services. However, the impact is confined to availability (no data disclosure, no code execution), and modern Windows deployments typically block port 445 at the perimeter. No KEV listing and no public exploit code are present, keeping real-world exploitation probability lower than the raw CVSS score might suggest. EPSS data was not provided. The combination of PR:N and AV:N means this could be scripted and automated if a PoC emerges, making timely patching important for any internet- or intranet-exposed Windows Server. |
| Exploit ScenarioDerived | An attacker with network connectivity to TCP 445 on an unpatched Windows Server 2022 or 2025 system sends a specially crafted SMB packet designed to trigger the null pointer dereference in srvnet.sys. The kernel driver crashes, causing an immediate system reboot or hang, disrupting all hosted services including file shares and Active Directory-dependent authentication. No credentials or prior foothold are required; the attack can be executed from any reachable host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
RemediationAI
Vendor-released patches are available for all affected builds via Windows Update and WSUS. The primary fix is to apply the Microsoft Security Update that brings affected systems to the corrected build versions: Windows Server 2022 to 10.0.20348.5622 or later, Windows Server 2025 and Windows 11 24H2 to 10.0.26100.33438/9445 or later, Windows 11 23H2 to 10.0.22631.7582 or later, Windows 11 25H2 to 10.0.26200.9445 or later, and Windows 11 26H1 to 10.0.28000.2954 or later. Details and patch downloads are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72949. Where immediate patching is not possible, the most effective compensating control is to block inbound TCP 445 (SMB) at network perimeter and host-based firewalls for all systems that do not require external SMB access - note this will disable SMB-based file sharing and domain operations from blocked networks. Restricting SMB access to trusted IP ranges is a less disruptive alternative with reduced blast radius.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in srvnet.sys, the kernel-mode network transport driver underpinning the Windows Server Message Block (SMB) protocol stack. CWE-476 (Null Pointer Dereference) indicates that a code path within the driver can be triggered by a crafted or malformed inbound SMB packet, causing the driver to dereference a NULL pointer, which results in a kernel-mode access violation and system crash (Blue Screen of Death / bugcheck). Because srvnet.sys operates at kernel privilege and handles network input before any authentication handshake completes, this defect is reachable by any unauthenticated network peer with connectivity to the SMB service (typically TCP 445). Affected builds span Windows Server 2022 (10.0.20348.x), Windows Server 2025 (10.0.26100.x), and Windows 11 versions 23H2, 24H2, 25H2, and 26H1.
Know when Windows 11 23h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable SMB pre-auth path, no credentials or interaction required, purely availability impact via kernel crash; provided vendor vector is accurate.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A vulnerability in the Windows SMB Server driver allows unauthenticated remote attackers to crash Windows 11 and Server 2022/2025 systems across your network, creating a denial-of-service risk for any organization with exposed file-sharing infrastructure. No active exploitation has been detected, but the attack requires no credentials or user interaction, making it a high-priority availability threat. Vendor patches are available, enabling rapid mitigation across your Windows estate.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows 11 23h2
View allInternet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Exploit-DB