This vulnerability, tracked as CVE-2026-40401 and classified under CWE-476 (NULL Pointer Dereference), affects Windows 10 Version 1607 (build 10.0.14393.0). It involves a flaw in the TCP/IP implementation that can be exploited to cause a denial of service by crashing the system. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix for this vulnerability.

Successful exploitation results in denial of service (system crash) without impacting confidentiality or integrity. The vulnerability requires local access to the affected system but does not require user interaction or privileges. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40401 to remediate this vulnerability.