CVE-2026-40406

What it actually does

CVE-2026-40406 is a remotely reachable use-after-free flaw in the Windows TCP/IP stack. An unauthenticated attacker on a network path that can send crafted traffic to an affected Windows host may trigger incorrect reuse of freed memory in kernel networking code, causing sensitive memory contents to be disclosed. The published impact is confidentiality-only: no privilege escalation, code execution, integrity modification, or denial of service is indicated by the provided scoring, but leaked memory may aid later exploitation by exposing kernel addresses, protocol state, or other in-memory data useful for bypassing defenses.

Why it matters to the business

Successful exploitation could allow an external or internal attacker to obtain sensitive information from Windows workstations or servers without credentials or user interaction. Because the affected scope includes many supported Windows client and server releases, exposure can be broad in enterprises with internet-facing Windows services, VPN-adjacent systems, or flat internal networks. The CVSS score is high at 7.5 due to unauthenticated network reachability, but the current EPSS is low and stable at 0.00931, there is no known KEV listing, no ransomware association, and no public exploit maturity reported, so remediation should be prioritized but not treated the same as an actively exploited emergency unless local exposure is high.

How an attack unfolds

An attacker first identifies an affected Windows host that accepts network traffic over TCP/IP from the attacker-controlled network location. They then send specially crafted packets designed to drive the vulnerable TCP/IP code path into freeing an object while a reference to it can still be used. When the stale reference is dereferenced, memory contents from the freed or reallocated region may be exposed back to the attacker through observable protocol behavior or response data. The attacker may repeat the process to collect additional memory fragments and correlate them into useful information, such as kernel memory layout or protocol/session artifacts. The flaw, as described, does not directly provide code execution, but the disclosed information could reduce the difficulty of follow-on attacks against the same host or service.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no exact fixed build or KB numbers were provided, use Microsoft Security Update Guide, Windows Update, WSUS, Intune, Configuration Manager, or the organization’s patch platform to confirm the applicable cumulative update for each OS release. Where immediate patching is not possible, reduce network reachability to affected systems: block unnecessary inbound traffic at host and network firewalls, restrict exposure from untrusted networks, segment servers by role, limit east-west access, and ensure only required TCP/IP services are reachable. Prioritize internet-facing Windows systems, domain infrastructure, management servers, jump hosts, VPN-adjacent systems, and high-value servers.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows asset has installed the Microsoft cumulative update or security update that supersedes the vulnerable TCP/IP components. Use authenticated vulnerability scanning, endpoint management inventory, or PowerShell-based patch inventory to compare OS edition, build, and installed hotfixes against Microsoft’s official fixed guidance. Validate that exposed systems are no longer flagged by vulnerability scanners for this CVE. For mitigations, confirm host firewall and perimeter rules block unnecessary inbound access from untrusted networks, and test from representative network segments that only intended services are reachable. Because this is a network-level information disclosure issue, absence of crashes or alerts is not proof of safety; patch/build verification is the most reliable validation method.

Typical attack path

1. Scan for reachable Windows hosts or services that accept network traffic from the attacker’s location.
2. Fingerprint operating system versions or infer likely exposure based on Windows release and patch level.
3. Send crafted TCP/IP traffic intended to trigger the use-after-free condition in the Windows networking stack.
4. Observe network responses or side effects that disclose memory contents.
5. Repeat the interaction to gather enough leaked information to support reconnaissance or subsequent exploitation.
6. Use the disclosed information to improve targeting of other vulnerabilities or to bypass memory-protection assumptions.

How to detect it

This vulnerability is difficult to confirm retrospectively because the described impact is information disclosure in the TCP/IP stack and may not create durable host artifacts, authentication failures, process launches, files, or registry changes. Review network telemetry for unusual, repeated, or malformed TCP/IP traffic directed at Windows hosts, especially from untrusted sources and especially around the time before patching. Useful sources include firewall logs, IDS/IPS alerts, packet captures, NetFlow/IPFIX, Windows Filtering Platform events, endpoint network telemetry, and EDR network connection records. Look for high-rate probing against many Windows hosts, repeated connection attempts with abnormal packet characteristics, unusual protocol resets, or IDS signatures released by vendors after disclosure. On hosts, review System event logs for network stack instability, driver faults, or unexpected reboots, but exploitation may leave no Windows event. If a suspected source is identified, pivot across telemetry for other reconnaissance or follow-on exploitation activity, because leaked memory may have been used to facilitate later attacks rather than to produce an obvious standalone compromise.

What your security team should do

• Inventory all affected Windows client and server versions and identify systems with network exposure to untrusted or broad internal segments.
• Prioritize patching of internet-facing Windows hosts, servers reachable from partner/VPN networks, domain controllers, management systems, and high-value application servers.
• Deploy the applicable Microsoft cumulative security updates through standard patch channels and track completion by OS build and installed KB status.
• Use compensating controls for systems that cannot be patched quickly: restrict inbound connectivity, tighten Windows Defender Firewall rules, apply segmentation, and remove unnecessary listening services.
• Run authenticated vulnerability scans after patch deployment to verify that the vulnerability is no longer detected.
• Monitor Microsoft advisories for updated fixed build information, exploitability assessment changes, or newly published exploitation details.
• Because EPSS is currently low and no KEV/ransomware activity is reported, schedule remediation within the normal high-severity patch window unless the asset is externally exposed or business-critical.