Is CVE-2026-40414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40414 being exploited in the wild.

How severe is CVE-2026-40414?

High severity, with a CVSS score of 7.4, published 12 May 2026.

Which products and versions are affected?

Microsoft Windows 10 1607, 1809, 21H2, 22H2; Microsoft Windows 11 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, 23H2.

Is there a fix for CVE-2026-40414?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40414 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-40414?

Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40414: Microsoft Windows TCP/IP null pointer dereference denial of service

CVE-2026-40414 · Severity: high · CVSS 7.4 · Published 2026-05-12

A vulnerability in the Windows networking stack could allow an attacker on the same local network to crash a computer or server. This affects the core component responsible for internet and network communications (TCP/IP). An exploit would result in a blue screen or system reboot, causing an immediate service outage and potential data loss for unsaved work.

Technologies: Microsoft Windows. Vendors: Microsoft.

Quick answers

Is CVE-2026-40414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40414 being exploited in the wild.
How severe is CVE-2026-40414?: High severity, with a CVSS score of 7.4, published 12 May 2026.
Which products and versions are affected?: Microsoft Windows 10 1607, 1809, 21H2, 22H2; Microsoft Windows 11 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, 23H2.
Is there a fix for CVE-2026-40414?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40414 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-40414?: Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference (CWE-476) exists within the Windows TCP/IP stack. An unauthenticated attacker located on the same local network or subnet (adjacent vector) can trigger this vulnerability by sending specially crafted network traffic. Successful exploitation results in a system crash (Bug Check), leading to a Denial of Service (DoS) condition. The vulnerability affects a wide range of Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025. Microsoft has released security updates to address this issue.

Affected products

Microsoft Windows 10 1607, 1809, 21H2, 22H2
Microsoft Windows 11 23H2, 24H2, 25H2, 26H1
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, 23H2

Timeline

2026-05-12: disclosed
2026-05-12: advisory: Microsoft published the security advisory and update guide.
2026-06-01: other: NVD record modified after enrichment.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40414

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.