cve 2026-40401

CVE-2026-40401 is a Microsoft-disclosed Windows TCP/IP denial-of-service vulnerability rated Important. It stems from a null pointer dereference and affects supported Windows client and server releases. The May 2026 security updates remediate the flaw. Notably, while the CVSS vector classifies it as a local attack, Microsoft's FAQ indicates that a low-privilege Hyper-V guest can exploit this bug to crash the host environment, crossing guest boundaries. This transforms a routine kernel-networking fix into a virtualization availability concern, making it a significant issue for enterprise IT environments relying on Hyper-V isolation.