Null pointer dereference in the Windows TCP/IP stack allows an unauthorized local attacker to cause a denial of service by corrupting a data structure, leading to a crash of the networking component. The flaw is a classic instance of CWE-476 and results in a loss of network connectivity for the affected computer. Only the local user or process that can exploit the bug would trigger the failure; remote exploitation is not supported by the description.

Affected Windows releases include Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 22H3; and all major Windows Server editions from Server 2012 through Server 2025 (including Server Core installations). No other vendors are listed in the CNA data.

The CVSS score is 7.1, indicating a high‑medium severity for denial of service. No EPSS score is supplied, so we cannot quantify current exploitation probability, and the vulnerability is not present in CISA’s KEV catalog. Based on the description, the likely attack vector is local privilege exploitation; an attacker must already have some level of local access to trigger the null dereference and cause the stack to crash.