EUVD-2026-29665
GHSA-mj3g-9j9x-c556
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated packet triggers a kernel null-deref crash with no user interaction, giving AV:N/AC:L/PR:N/UI:N; DoS-only means C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in the Microsoft Windows TCP/IP stack (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a remote, unauthenticated attacker to crash the affected system by triggering a null pointer dereference over the network. No public exploit has been identified at time of analysis and the EPSS probability is low (0.14%, 34th percentile), but the flaw is network-reachable with no privileges or user interaction and CISA SSVC rates it automatable. Impact is limited to availability - no code execution or data disclosure.
Technical ContextAI
The vulnerability resides in the Windows TCP/IP networking stack (tcpip.sys), the kernel-mode driver that processes IPv4/IPv6, TCP, UDP and related packet parsing for all inbound and outbound network traffic. The root cause is CWE-476 (NULL Pointer Dereference): a code path processes a crafted or unexpected packet without validating that a required pointer/object was successfully allocated or initialized, and the subsequent dereference of that null pointer faults in kernel context, producing a bugcheck (BSOD). Because the vulnerable code lives in a core OS component reachable from the network before authentication, the affected surface is the operating system itself rather than an optional application, per the CPE data covering Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 including Server Core.
RemediationAI
Apply the Microsoft security update for CVE-2026-40405, which is available from the vendor per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40405); install the fixed cumulative build for your channel - 10.0.26100.8457 for Windows 11 24H2, 10.0.26200.8457 for 25H2, 10.0.28000.2113 for 26H1, and 10.0.26100.32860 for Windows Server 2025 and its Server Core installation. If patching must be delayed, reduce exposure of the TCP/IP attack surface: restrict inbound network reachability to affected hosts using host and perimeter firewall rules so that only trusted management networks can send traffic to them, and segment internet-facing Windows Server 2025 systems behind filtering - noting the trade-off that overly tight filtering may break legitimate services that must accept connections. Because the flaw is in the core network stack rather than a toggleable feature, there is no clean feature-disable workaround, so network-level access restriction and prompt patching are the practical controls; monitor for unexplained bugchecks/BSODs on exposed hosts as a detection signal.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today