CVE-2026-40401: Windows 10 1607 DOS Vulnerability

CVE-2026-40401 Overview

CVE-2026-40401 is a null pointer dereference vulnerability [CWE-476] in the Windows TCP/IP networking stack. The flaw allows an unauthorized local attacker to trigger a denial of service condition on affected Microsoft Windows client and server systems. The vulnerability impacts a broad range of supported Windows versions, from Windows 10 1607 through Windows 11 26h1, and from Windows Server 2012 through Windows Server 2025. Microsoft published the advisory on May 12, 2026.

Critical Impact

A local, unauthenticated attacker can cause a high-availability impact by crashing the TCP/IP stack, disrupting all network-dependent services on the affected host.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
• Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-05-12 - CVE-2026-40401 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-40401

Vulnerability Analysis

The vulnerability resides in the Windows TCP/IP stack, a kernel-mode networking component (tcpip.sys) that processes IP, TCP, and UDP traffic. A specific code path fails to validate a pointer before dereferencing it. When the attacker triggers that path with crafted input, the kernel dereferences a null pointer and raises an unhandled exception.

Because the fault occurs in kernel context, the result is a system bugcheck (blue screen) and forced restart. The scope is marked as changed in the CVSS vector, indicating the impact extends beyond the vulnerable component to affect the whole operating system.

The attack requires local access but no privileges and no user interaction. An attacker with the ability to execute code on the host, or to send local network input processed by the affected code path, can repeatedly crash the system.

Root Cause

The root cause is missing validation of a pointer returned by an internal allocation or lookup routine within the TCP/IP stack. The code assumes the pointer is non-null and proceeds to read or write through it, which produces a kernel access violation when the assumption fails. CWE-476 classifies this class of defect.

Attack Vector

Exploitation requires local access to the target system. The attacker submits crafted network input or invokes an API that traverses the vulnerable code path in the TCP/IP driver. No authentication is needed, and no user interaction is required. The outcome is loss of availability; confidentiality and integrity are not affected. Memory disclosure or code execution paths are not indicated by Microsoft's advisory.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-40401

Indicators of Compromise

• Unexpected system bugchecks referencing tcpip.sys in Windows memory dump files (MEMORY.DMP, Minidump\*.dmp)
• Event ID 1001 (BugCheck) entries in the System event log following local user activity
• Repeated unplanned reboots on hosts where local users or low-privilege processes are active

Detection Strategies

• Correlate kernel crash dumps with the loaded driver list to identify faults attributable to the TCP/IP stack
• Monitor for clusters of unscheduled reboots across endpoints, particularly on multi-user systems such as RDS hosts and jump servers
• Alert on local processes that generate high volumes of raw socket or loopback traffic preceding a system fault

Monitoring Recommendations

• Forward Windows System and Application event logs to a centralized log platform and create alerts for BugCheck events
• Track patch compliance for the May 2026 Microsoft security update across all affected SKUs
• Baseline normal reboot patterns per host so anomalous restart frequency is detected quickly

How to Mitigate CVE-2026-40401

Immediate Actions Required

• Apply the May 2026 Microsoft security update referenced in the Microsoft CVE-2026-40401 Advisory to all affected Windows clients and servers
• Prioritize patching on multi-user systems, terminal servers, and shared workstations where local access is broader
• Audit local user accounts and remove unnecessary interactive logon rights to reduce the local attack surface

Patch Information

Microsoft has released security updates addressing CVE-2026-40401 through the standard Windows Update channels. Refer to the Microsoft Security Response Center advisory for the specific KB articles that correspond to each affected Windows version and architecture.

Workarounds

• No vendor-supplied workaround is documented; applying the security update is the recommended remediation
• Restrict interactive and remote local logon to trusted administrative accounts until patches are deployed
• Enable automatic system recovery so hosts return to service quickly if a crash occurs during the patch window

# Verify patch installation status on Windows hosts
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20