Microsoft Windows Layer-2 Bridge Network Driver: Denial of service

Summary

A missing memory release in the Windows Layer-2 Bridge Network Driver allows an unauthenticated attacker on the same adjacent network to cause a denial of service. Successful exploitation can crash or hang affected Windows systems that use this kernel-mode component. Exploitation requires high attack complexity, no privileges and no user interaction. Microsoft reports no exploitation and no public exploit code.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7711
• Windows 11 Version 24H2, 25H2, 26H1, 26H2: see the fixed builds below (sources differ, verify on MSRC)
• Windows Server 2019 (including Server Core): 10.0.17763.0 to below 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to below 10.0.26100.33822

Fixed in

• November 2026 security updates (released 10 November 2026) for all affected Windows versions
• Fixed builds per CVE record: 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.20348.5870, 10.0.26100.33822, 10.0.26200.9974 (Windows 11 25H2) and 10.0.28000.3501 (Windows 11 26H1)
• Windows 11 24H2 build differs between sources (9974 vs. 33822): confirm in the MSRC advisory
• KB article numbers: check the MSRC page

Workaround

Unknown.

Exploitation

• Microsoft exploitability assessment: Exploited: No
• No publicly available exploit code known
• Not listed in CISA KEV according to the sources reviewed; re-check before relying on this

Our recommendation

• Install the November 2026 cumulative updates in the next maintenance window
• Prioritise hosts that use the bridge component or act as hypervisors, and segments with untrusted devices such as guest Wi-Fi or flat VLANs
• Check support status of Windows 10 1809, 21H2 and 22H2, as these builds may no longer receive updates
• Verify the fixed build for your Windows version in the MSRC advisory

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-108402 msrc.microsoft.com
• CVE Record CVE-2026-108402 www.cve.org
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Strix: CVE-2026-108402 (aggregator, not authoritative) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:35.