CVE-2026-72949: Windows SMB Server DOS Vulnerability

CVE-2026-72949 Overview

CVE-2026-72949 is a null pointer dereference vulnerability in the Windows SMB Server Network Transport Driver (srvnet.sys). An unauthenticated remote attacker can trigger the dereference over the network, causing the affected Windows system to enter a denial-of-service condition. The flaw is tracked under CWE-476: NULL Pointer Dereference and affects the Server Message Block (SMB) network stack used for file and printer sharing across Windows environments.

Critical Impact
Remote, unauthenticated attackers can crash the SMB Server component of vulnerable Windows systems, disrupting file sharing services and forcing a reboot without any user interaction.

Affected Products

Microsoft Windows (SMB Server Network Transport Driver, srvnet.sys)
Windows Server editions exposing SMB services
Windows client editions with SMB Server functionality enabled

Discovery Timeline

2026-09-08 - CVE-2026-72949 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72949

Vulnerability Analysis

The vulnerability resides in srvnet.sys, the kernel-mode driver that handles SMB network transport on Windows. The driver dereferences a pointer that can be null under attacker-controlled conditions when processing crafted SMB traffic. Because srvnet.sys runs in kernel space, the resulting access violation triggers a bug check and system crash rather than a contained user-mode fault.

The issue is exploitable across the network without authentication or user interaction. Successful triggering does not lead to code execution or data disclosure; the impact is limited to availability. The EPSS model assigns this issue a probability of 1.149% at the 64.977 percentile, indicating moderate exploitation likelihood among published CVEs.

Root Cause

The root cause is a missing validation check before dereferencing a pointer within the SMB transport parsing path. When a specific SMB request state is reached with the underlying object uninitialized or already released, the driver accesses an invalid memory address. This condition maps directly to CWE-476.

Attack Vector

An attacker sends specially crafted SMB packets to TCP port 445 on a vulnerable Windows host. The malformed sequence forces srvnet.sys down a code path where the null pointer is dereferenced. The system responds with a stop error, terminating active SMB sessions and rendering the host unavailable until it restarts.

No authentication, privileges, or user interaction are required. Any host with SMB Server reachable from the attacker's network position is at risk.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Update Guide for CVE-2026-72949 for authoritative technical details.

Detection Methods for CVE-2026-72949

Indicators of Compromise

Unexpected bug checks or stop errors referencing srvnet.sys in Windows kernel crash dumps.
Sudden termination of SMB sessions followed by system reboots on file servers or endpoints exposing SMB.
Anomalous inbound SMB traffic to TCP port 445 from untrusted or external sources preceding host unavailability.

Detection Strategies

Monitor Windows Event Log for System events 1001 (BugCheck) and 41 (Kernel-Power) correlated with SMB service disruption.
Deploy network intrusion detection signatures for malformed SMB negotiation and transport packets targeting port 445.
Correlate crash telemetry from endpoints with concurrent inbound SMB connections in SIEM data to identify targeted DoS attempts.

Monitoring Recommendations

Enable kernel dump collection on SMB-facing servers to preserve srvnet.sys fault artifacts for triage.
Track availability metrics on file servers to detect repeated unplanned reboots that may indicate exploitation attempts.
Alert on inbound SMB traffic from outside expected network segments, particularly from the internet or guest networks.

How to Mitigate CVE-2026-72949

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72949 as soon as it is available in your patch cycle.
Block inbound TCP port 445 at perimeter firewalls to prevent external exploitation attempts.
Inventory all Windows hosts with SMB Server enabled and prioritize patching for internet-exposed or high-availability systems.

Patch Information

Microsoft has published the fix and advisory guidance for this vulnerability through the Microsoft Security Response Center. Consult the Microsoft Security Update for CVE-2026-72949 for the specific KB articles and build numbers applicable to each Windows release.

Workarounds

Restrict SMB access using host-based firewall rules that permit connections only from trusted management subnets.
Disable the SMB Server service on Windows systems that do not require file or printer sharing.
Enforce network segmentation to isolate SMB-exposed servers from untrusted user and guest networks.

bash

# Example: Restrict SMB inbound traffic to a trusted subnet using Windows Firewall
New-NetFirewallRule -DisplayName "Restrict SMB to Trusted Subnet" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 445 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow

# Block SMB from all other sources
New-NetFirewallRule -DisplayName "Block SMB from Untrusted Sources" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 445 `
  -Action Block