Windows TCP/IP: Denial of Service through null pointer dereference

Summary

A null pointer dereference in the Windows TCP/IP networking stack allows an unauthenticated remote attacker to cause a denial of service. Successful exploitation can crash or hang affected Windows systems that are reachable over the network. The impact is limited to availability; no confidentiality or integrity impact is stated.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016, 2019, 2022 (including Server Core installations)
• Windows Server 2025: Unknown (not in the official CVE record; verify in the MSRC table)

Fixed in

Per the official CVE record, the following builds are fixed; install the November 2026 security update:

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9688
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2022: 10.0.20348.5870
• Windows Server 2025: Unknown

Workaround

Unknown. No vendor workaround or mitigation was found in the sources. Patching is the primary measure.

Exploitation

• No evidence of in-the-wild exploitation was found.
• No public proof of concept was found.
• CISA SSVC assessment: exploitation none; automatable: yes.
• Listing in the CISA KEV catalogue could not be confirmed.

Our recommendation

• Install the November 2026 Windows security update on all affected hosts, starting with internet-facing and network-exposed servers.
• Prioritise Windows Server 2016/2019/2022 and Windows 10 1607/1809 hosts, which are common in SME environments and may need upgrading or replacement.
• Check which hosts are reachable from the internet or untrusted networks and restrict unnecessary network access.
• Monitor affected systems for crashes, hangs or unusual network traffic.
• Confirm the affected-products table in the MSRC Security Update Guide before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96077 msrc.microsoft.com
• CVE Record: CVE-2026-96077 www.cve.org
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• Strix: CVE-2026-96077 (secondary, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:04.