{"id":"CVE-2026-96077","kind":"vulnerability","aliases":["CVE-2026-96077"],"related":[],"title":"Windows TCP/IP: null pointer flaw lets a network attacker crash systems","description":"Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.","summary":"A null pointer dereference in the Windows TCP/IP networking stack can be triggered by an unauthorized attacker over the network. The result is a denial of service, meaning affected machines can be made to crash or stop responding.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 / Server 2016 (1607)","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["denial-of-service","infrastructure","network","servers","tcp-ip","title-review","windows"],"not_affected_if":[],"how_to_check":"Run winver or (Get-ComputerInfo).OsBuildRevision and compare to the fixed builds: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 17763.9487; Win10 21H2/22H2 19044/19045.7846; Win11 23H2 22631.7711; Win11 24H2/25H2/26H2 build 9974 (26100/26200/26300); 26H1 28000.3501; Server 2022 20348.5870; Server 2025 26100.33822. Any lower build is exposed. Confirm the KB number on Microsoft's update guide.","fix":"Install the November 2026 Windows cumulative update bringing the build to at least the fixed build for your version. KB number not confirmed.","status":"open","published_at":"2026-11-10T19:22:06+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:42:55+00:00","updated_at":"2026-11-10T19:54:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows TCP/IP: null pointer flaw lets a network attacker crash systems","impact":"low","summary":"A null pointer dereference in the Windows TCP/IP networking stack can be triggered by an unauthorized attacker over the network. The result is a denial of service, meaning affected machines can be made to crash or stop responding.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","tcp-ip","servers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker crashes Windows machines over the network","analyst_note":"Check Microsoft's security update guide for CVE-2026-96077 for affected Windows builds, the fixed update, and any detection steps; the NVD entry alone gives no versions.","how_to_check":"- unknown","plain_action":"","product_name":"Windows TCP/IP","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Windows machine reachable over the network with the affected TCP/IP stack is potentially exposed, including servers and workstations. The sources do not list affected Windows builds or whether any non-default configuration is required. Teams should confirm affected versions against Microsoft's advisory.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4488,"output_tokens":494,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide for CVE-2026-96077 for affected Windows builds, the fixed update, and any detection steps; the NVD entry alone gives no versions.","search":"'-2026':13A,16A '-96077':14A,17A '10':19A,24A,29A,32A '11':35A,38A,41A,44A,47A '1607':22A '1809':25A '2016':21A '2019':27A '2022':51A '2025':54A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A 'affect':97B 'allow':113C 'attack':9A,85B,116C 'crash':10A,103B 'cve':12A,15A 'deni':118C 'denial':56B,93B 'denial-of-servic':55B 'derefer':72B,109C 'flaw':5A 'infrastructur':59B 'ip':64B 'let':6A 'machin':98B 'made':101B 'mean':96B 'network':8A,60B,77B,88B,122C 'null':3A,70B,107C 'pointer':4A,71B,108C 'respond':106B 'result':90B 'review':67B 'server':20A,26A,50A,53A,61B 'servic':58B,95B,119C 'stack':78B 'stop':105B 'system':11A 'tcp':63B 'tcp-ip':62B 'tcp/ip':2A,76B,112C 'titl':66B 'title-review':65B 'trigger':81B 'unauthor':84B,115C 'window':1A,68B,75B,111C 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2016-2025 machine with a build below the fixed one can be crashed by an unauthenticated network attacker, with no user interaction. Internet-facing Windows servers and hosts are the priority. Fully patched systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","10server20161607","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows10server20161607","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["denialofservice","high","infrastructure","network","servers","tcpip","titlereview","vendor","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96077':14A,17A '10':19A,24A,29A,32A '11':35A,38A,41A,44A,47A '1607':22A '1809':25A '2016':21A '2019':27A '2022':51A '2025':54A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A 'attack':9A 'crash':10A 'cve':12A,15A 'flaw':5A 'let':6A 'network':8A 'null':3A 'pointer':4A 'server':20A,26A,50A,53A 'system':11A 'tcp/ip':2A 'window':1A 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","search_b":"'affect':97B 'attack':85B 'crash':103B 'denial':56B,93B 'denial-of-servic':55B 'derefer':72B 'infrastructur':59B 'ip':64B 'machin':98B 'made':101B 'mean':96B 'network':60B,77B,88B 'null':70B 'pointer':71B 'respond':106B 'result':90B 'review':67B 'server':61B 'servic':58B,95B 'stack':78B 'stop':105B 'tcp':63B 'tcp-ip':62B 'tcp/ip':76B 'titl':66B 'title-review':65B 'trigger':81B 'unauthor':84B 'window':68B,75B","search_c":"'allow':113C 'attack':116C 'deni':118C 'derefer':109C 'network':122C 'null':107C 'pointer':108C 'servic':119C 'tcp/ip':112C 'unauthor':115C 'window':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96077","severity":null,"published_at":"2026-11-10T19:22:06+00:00","modified_at":"2026-11-10T19:22:06+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96077:2575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96077","severity":null,"published_at":"2026-11-10T19:54:04+00:00","modified_at":"2026-11-10T19:54:04+00:00","first_seen_at":"2026-11-10T19:54:04+00:00","fetched_at":"2026-11-10T19:54:04+00:00","note":"MSRC page is JS-only and unreadable here; builds taken from NVD's Microsoft-CNA affected list, so nothing marked verified. No exploitation/PoC found; X and social search not run.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96077"]}],"documents":[{"id":117709,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96077","title":"NVD CVE-2026-96077 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}