CVE-2026-108402: Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability

Below is a complete technical breakdown of the official MSRC advisory, what the underlying weakness means for Windows administrators, and the exact KB-to-build mappings required across Windows 10, Windows 11, and Windows Server environments.

Official Advisory Overview and Risk Profile​

According to MSRC, the core issue is straightforward and officially summarized as follows:

Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability: Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network.

Click to expand...

Specifically, the vulnerability description states: Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network.

Here are the authoritative vulnerability metrics and status indicators from MSRC:

• CVE ID: CVE-2026-108402
• Title: Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
• Severity: Important
• CVSS Base Score: 5.3
• CVSS Temporal Score: 4.6
• CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-401
• Exploitation Assessment: Exploitation Unlikely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Section Summary​

CVE-2026-108402 carries an Important severity rating with a 5.3 base score and 4.6 temporal score. Although active attacks have not been observed and MSRC rates exploitation as Exploitation Unlikely, administrators still need to deploy the corresponding cumulative updates.

Technical Analysis: CWE-401 and Adjacent Network Exposure​

To understand why a base score of 5.3 still earns an Important label from Microsoft, it helps to unpack both the weakness class and the CVSS v3.1 vector string from general industry knowledge of Windows networking architecture and CVSS scoring standards.

Memory Leaks in Network Drivers (CWE-401)​

CWE-401 denotes a missing release of memory after its effective lifetime—better known in everyday sysadmin parlance as a memory leak. When an ordinary user-mode application forgets to free memory, you restart the app and grumble at the developer. When a network driver fails to release allocated memory buffers after processing traffic, the stakes are much higher. Over time, repeated allocations that are never reclaimed can deplete system memory pools, starve critical services, or force an unresponsive host offline.

Decoding the CVSS Vector​

Every component of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C tells a practical story for defenders:

• Attack Vector — Adjacent (AV:A): An attacker cannot trigger this flaw across the open internet across routed hops. Instead, the adversary must share the same physical or logical Layer-2 broadcast/collision domain—such as a local Ethernet VLAN, shared Wi-Fi network, or bridged virtual switch segment.
• Attack Complexity — High (AC:H): Successful exploitation depends on specific conditions beyond the attacker's immediate control, such as target bridging state or timing constraints, which aligns with Microsoft's Exploitation Unlikely assessment.
• Privileges Required — None (PR:N) & User Interaction — None (UI:N): No credentials, domain membership, or user clicks are needed to send crafted traffic from an adjacent position.
• Scope — Unchanged (S:U): The impact remains confined to the vulnerable component's security authority.
• Impact Metrics (C:N/I:N/A:H): There is no confidentiality (C:N) or integrity (I:N) compromise—data isn't stolen or modified—but availability impact is High (A:H), reflecting the potential for a complete denial of service on the affected Windows system.
• Temporal Metrics (E:U/RL:O/RC:C): Exploit Code Maturity is Unproven (E:U), Remediation Level is Official Fix (RL:O), and Report Confidence is Confirmed (RC:C), bringing the temporal score down to 4.6.

Why should IT pros care if an attacker already has to be on the local network? Think about multi-tenant campus Wi-Fi, conference room jacks, lab environments, or virtualized server clusters where Layer-2 bridging connects workloads. If an unauthorized device lands on a shared segment—or a single compromised workstation starts probing neighbors—an unpatched Layer-2 driver turns a local nuisance into an availability outage.

Section Summary​

Because CVE-2026-108402 relies on an adjacent network vector (AV:A) and high attack complexity (AC:H), internet-facing perimeter exposure is limited, yet internal LANs, shared wireless segments, and bridged server environments remain vulnerable to availability disruption until patched.

Affected Products, KBs, and Fixed Builds​

Microsoft's remediation spans 24 distinct product entries across Windows 10, Windows 11, and Windows Server (including Server Core installations). Note that several Windows 11 releases (24H2, 25H2, and 26H2) and Windows Server 2025 list two KB update paths corresponding to separate fixed build targets.

Official Remediation Requirements by Platform​

To ensure exact compliance verification across patch management tools, confirm each system reaches its designated fixed build as specified by Microsoft:

• For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows 10 Version 1809 for x64-based Systems, install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5131096 to reach fixed build 10.0.19044.7846.
• For Windows 10 Version 21H2 for ARM64-based Systems, install KB5131096 to reach fixed build 10.0.19044.7846.
• For Windows 10 Version 21H2 for x64-based Systems, install KB5131096 to reach fixed build 10.0.19044.7846.
• For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5131096 to reach fixed build 10.0.19045.7846.
• For Windows 10 Version 22H2 for ARM64-based Systems, install KB5131096 to reach fixed build 10.0.19045.7846.
• For Windows 10 Version 22H2 for x64-based Systems, install KB5131096 to reach fixed build 10.0.19045.7846.
• For Windows 11 Version 23H2 for ARM64-based Systems, install KB5131087 to reach fixed build 10.0.22631.7711.
• For Windows 11 Version 23H2 for x64-based Systems, install KB5131087 to reach fixed build 10.0.22631.7711.
• For Windows 11 Version 24H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26100.9911; install KB5132061 to reach fixed build 10.0.26100.9974.
• For Windows 11 Version 24H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26100.9911; install KB5132061 to reach fixed build 10.0.26100.9974.
• For Windows 11 Version 25H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26200.9911; install KB5132061 to reach fixed build 10.0.26200.9974.
• For Windows 11 Version 25H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26200.9911; install KB5132061 to reach fixed build 10.0.26200.9974.
• For Windows 11 Version 26H1 for ARM64-based Systems, install KB5132059 to reach fixed build 10.0.28000.3501.
• For Windows 11 version 26H1 for x64-based Systems, install KB5132059 to reach fixed build 10.0.28000.3501.
• For Windows 11 Version 26H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26300.9911; install KB5132061 to reach fixed build 10.0.26300.9974.
• For Windows 11 Version 26H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26300.9911; install KB5132061 to reach fixed build 10.0.26300.9974.
• For Windows Server 2019 (Server Core installation) (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows Server 2019 (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
• For Windows Server 2022 (Server Core installation) (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
• For Windows Server 2022 (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
• For Windows Server 2025 (Server Core installation) (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
• For Windows Server 2025 (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.

Section Summary​

Nine distinct security updates (KB5131077, KB5131080, KB5131085, KB5131087, KB5131090, KB5131096, KB5132043, KB5132059, and KB5132061) remediate CVE-2026-108402 across all listed client and server SKUs.

Practical Deployment Guidance for Windows Administrators​

Based on general enterprise patch management practice, rolling out fixes for CVE-2026-108402 does not require emergency out-of-band heroics at 2:00 AM, given that Publicly disclosed: No, Exploited: No, and MSRC assesses it as Exploitation Unlikely. However, because Customer action required: Yes, skipping the update leaves high-uptime servers and shared-segment endpoints unnecessarily exposed to memory exhaustion.

1. Prioritize Bridged Hosts and Shared Segments: Start deployment rings with Windows Server 2019, Windows Server 2022, and Windows Server 2025 hosts participating in Layer-2 bridging or dense VLANs, alongside Windows 10 and Windows 11 endpoints operating on untrusted or guest-adjacent wireless networks.
2. Audit OS Build Revisions, Not Just Update History: Especially on Windows 11 versions 24H2, 25H2, and 26H2—which share servicing packages (KB5132043 and KB5132061) across distinct base builds (26100, 26200, and 26300)—and on Windows Server 2025 (KB5131077 and KB5131080), verify the post-reboot OS build number directly rather than relying solely on pending-install flags.
3. Maintain Layer-2 Segmentation: As standard defense-in-depth practice, network access control, VLAN isolation, and client isolation on wireless networks sharply reduce the blast radius of any AV:A (Adjacent Network) vulnerability while maintenance windows catch up.

If you are tracking broader cumulative update behavior or testing server rollouts across your Windows estate, check out our ongoing Windows 11 updates, Windows Server administration, and Microsoft security patches discussions right here on WindowsForum.com to compare notes with fellow sysadmins.

Section Summary​

Treat CVE-2026-108402 as a standard-cadence Important patch priority: deploy the exact KB update matching each architecture and OS version, confirm the target build numbers post-reboot, and keep Layer-2 network segmentation tight.