EUVD-2026-29671
GHSA-r58x-7f7v-85gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position
-
DeliverySend crafted malformed packet
-
ExploitTrigger null pointer dereference in tcpip.sys
-
ExecutionKernel bugcheck (BSOD)
-
ImpactHost denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold an adjacent-network position (CVSS AV:A) - the same logical link, subnet, or broadcast domain as the target - meaning it is not exploitable across the open internet without such proximity; there is no authentication requirement (PR:N) and no user interaction (UI:N). Beyond network adjacency and the ability to send crafted packets to the Windows TCP/IP stack, no special product feature toggle or non-default configuration is documented as required, since TCP/IP is enabled by default on all affected Windows editions. The principal limiting factors are the adjacency prerequisite and the impact ceiling: the outcome is confined to denial of service (A:H, C:N/I:N) with no code execution or data exposure. |
| Impact | The signals converge on a genuine but bounded risk. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 7.4 High) shows the attack requires only adjacent-network position, no privileges and no user interaction, with a scope change and high availability impact but zero confidentiality or integrity impact - consistent with a pure DoS. This aligns with CISA SSVC: Technical Impact 'partial' (availability only), Automatable 'no', Exploitation 'none'. EPSS is low at 0.14% (34th percentile), and there is no KEV listing and no known POC, so this is not an active-exploitation priority. The limiting factor is the AV:A adjacency requirement: the attacker must be on the same logical link/subnet (e.g., same LAN or broadcast domain), which sharply reduces remote internet exposure compared to an AV:N flaw. Net: patch on the normal Patch Tuesday cadence, prioritizing multi-tenant or hostile-adjacent network segments; this is not an emergency-out-of-band scenario. |
| Exploit ScenarioDerived | An attacker on the same LAN or subnet as a Windows host (for example, a rogue device on a shared corporate or guest network) sends a crafted sequence of malformed packets to the target's TCP/IP stack. The packet drives a null pointer dereference in kernel-mode networking code, causing an immediate bugcheck (BSOD) and taking the machine offline. No credentials or user interaction are needed, but no code execution or data theft occurs, and no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
RemediationAI
Apply the Microsoft security update for your specific Windows build; Vendor-released patch: install the cumulative update that brings each SKU to at least its fixed build (e.g., Windows 11 24H2 to 10.0.26100.8457, Windows 10 22H2 to 10.0.19045.7291, Server 2022 to 10.0.20348.5139, Server 2025 to 10.0.26100.32860) per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40414. Because the vector is adjacent-network (AV:A), effective compensating controls until patching include restricting layer-2/subnet adjacency to trusted hosts, segmenting untrusted or guest devices onto isolated VLANs, and enforcing host firewall and network ACLs to limit exposure of the affected system to unknown adjacent peers - with the trade-off that overly aggressive filtering of the relevant protocol traffic can disrupt legitimate connectivity. There is no confidentiality/integrity exposure, so the compensating goal is availability protection of the host until the update is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 21 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Windows TCP/IP stack (tcpip.sys), the kernel-mode driver responsible for parsing and handling IPv4/IPv6, TCP, UDP and related protocol traffic. The root cause is a CWE-476 null pointer dereference, meaning a specially crafted packet drives a code path that dereferences a pointer without validating it is non-null, faulting the kernel and forcing a bugcheck (BSOD). Because the code executes in kernel context, a crash takes down the entire operating system rather than a single process. The CPE set spans Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025, confirming the defect lives in shared core networking code common to all these releases.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Adjacent unauthenticated packet triggers a kernel crash with no interaction, so AV:A/AC:L/PR:N/UI:N and A:H only; scope changes as the kernel bugcheck downs the whole host.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.
Executive ViewAI
A high-severity Windows TCP/IP vulnerability (CVE-2026-40414, CVSS 7.4) affecting Windows 10 through Windows 11 and Server editions 2012-2025 allows unauthenticated adjacent-network attackers to crash systems, impacting the entire Windows infrastructure across most organizations. While no public exploit identified at time of analysis and exploitation risk remains minimal, the broad organizational footprint makes this a near-term remediation priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB