This vulnerability (CVE-2026-40405) is a null pointer dereference in the Windows TCP/IP implementation affecting Windows 11 Version 24H2 (build 10.0.26100.0). Exploitation can lead to denial of service by crashing or destabilizing the affected system's network stack. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An attacker can remotely cause a denial of service condition on affected Windows 11 Version 24H2 systems by exploiting the null pointer dereference in the TCP/IP stack. This results in disruption of network services and potential system instability or crash. There is no impact on confidentiality or integrity according to the CVSS vector.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40405 to remediate this issue. No additional mitigation steps are indicated by the vendor.