This vulnerability (CVE-2026-40413) is a NULL pointer dereference (CWE-476) in the TCP/IP implementation of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It can be triggered remotely (attack vector: adjacent network) without privileges or user interaction, resulting in denial of service by causing the affected system to crash or become unresponsive. The vulnerability has a CVSS 3.1 base score of 7.4 (high severity) with no confidentiality or integrity impact but high impact on availability. Microsoft has released an official fix to remediate this issue.

Successful exploitation leads to denial of service by crashing or destabilizing the affected Windows 10 Version 1607 system's TCP/IP stack. There is no impact on confidentiality or integrity, but availability is severely affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40413 to remediate this vulnerability.